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ABSTRACT 


After  the  politieal  regime  in  the  former  Yugoslavia  eollapsed  at  the  beginning  of  the 
1990s,  followed  by  the  ethnie  eivil  wars  in  Bosnia  and  Kosovo,  the  Balkans  turned  into 
an  arena  for  the  spread  of  Islamie  fundamentalism  and  terrorism.  As  a  result,  the  region 
has  posed  a  potential  threat  within  Europe’s  borders  and  beyond.  In  2012,  Bulgaria 
beeame  the  target  of  a  terrorist  attaek.  Although  the  attaek  was  direeted  against  Israeli 
interests,  the  event  revealed  a  breaeh  in  Bulgaria’s  national  seeurity.  The  purpose  of  this 
thesis  is  to  illustrate  how  Bulgaria  eould  develop  a  strategy  to  proteet  itself  from  sueh 
terrorist  threats.  Sinee  this  thesis  relies  on  open-souree  historieal  data,  rather  than  eurrent 
information,  its  value-added  eontribution  is  the  proeess  it  demonstrates  for  eolleeting  and 
analyzing  data,  as  opposed  to  reeommending  a  partieular  strategy. 
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I.  INTRODUCTION 


A.  THE  BALKAN  CONTEXT 

One  of  the  most  serious  unresolved  issues  of  the  twenty-first  eentury  concerning 
national  security  is  terrorism.  The  terrorist  attack  on  the  World  Trade  Center  in  New 
York  City  on  9/1 1,  the  attacks  in  Spain,  England,  and  many  other  places,  have  shown  that 
threats  and  risks  to  international  security  are  global  and  borderless.  The  escalation  of 
terrorism  by  religious  and  ethnic  groups  seems  to  be  growing.!  In  the  years  after  1990, 
“wars  and  political  instability  provided  an  opportunity  for  A1  Qaeda  and  other  terrorist 
groups  to  infiltrate”  many  corners  of  the  world,  including  the  Balkans,  a  region 
characterized  by  a  significant  Muslim  population,  “weak  border  controls,  and  security 
services. ”2  The  Balkan  Peninsula  has  always  been  a  unique  and  dynamic  region. 
Currently,  peace  in  the  Balkans  is  tenuous,  a  consequence  of  the  ethnic  and  religious 
conflicts  of  the  last  two  decades,  extremist  political  leaders,  organized  crime, 
paramilitaries,  and  connections  to  large  networks  of  international  terrorist  organizations. ^ 

1.  Fertile  Ground  for  Terrorism 

In  terms  of  religion,  the  presence  of  a  Muslim  population  in  the  Balkans  “fits  in 
well  with  the  global  vision  of  A1  Qaeda  and  its  affiliates,  which  aspire  to  achieve  the 
triumph  of  Islamic  culture  over  Western  culture  (and  other  Islamic  foes),  and  to  establish 
the  ‘Umma’ — the  community  of  faithful  Muslims  which  will  unite  all  Muslims  and 
position  Islam  as  the  main  global  force.”"!  Thousands  of  fighters,  mainly 
Afghan  “alumni,”  arrived  to  fight  the  Bosnia  war,  which  spread  the  ideology  of  radical 


1 .  Vasil  Prodanov  and  Bogdana  Tomova,  Risks  for  Bulgaria  of  Islamic  Fundamentalism  and  Terrorism 
(Sofia,  Bulgaria:  Bulgarian  Scientific  Academy,  2005),  17. 

2.  Steven  Woehrel,  Islamic  Terrorism  and  the  Balkans,  CRS  Report  RL33012  (Washington,  DC: 
Library  of  Congress,  Congressional  Research  Service,  July  26,  2005). 

3-  Prodanov  and  Tomova,  Risks  for  Bulgaria  of  Islamic  Fundamentalism  and  Terrorism,  14. 

Shaul  Shay,  “Islamic  Terror  and  the  Balkans,”  in  Islamic  Terror  and  the  Balkans  (New  Brunswick, 
NJ  and  London,  International  Policy  Institute  for  Counter-Terrorism,  2007),  202. 
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Islamic  terror  over  the  Muslim  population  in  Albania,  Kosovo,  and  Macedonia  (the 
Former  Yugoslavian  Republic  of  Macedonia,  FYROM).  ^ 

During  the  war  in  Bosnia  and  Herzegovina,  a  displaeed  and  poor  Bosniak 
population  and  the  Bosnian  government  aeeepted  the  help  of  Iran  in  terms  of  money  and 
weapons,  as  well  as  several  thousand  Islamie  radicals  and  mercenaries.^  Many  of  them 
were  Mujahidin  from  the  Iranian  Revolutionary  Guard  and  fighters  from  Afghanistan. ^ 
After  the  Dayton  Peaee  Agreement  in  1995,  some  of  these  fighters  remained  and  gained 
eitizenship  through  marriage  or  by  bribing  Bosnian  officials.*  The  importance  of  Bosnia 
was  mentioned  by  Bin  Laden  and  others  in  the  high  ranks  of  A1  Qaeda  as  a  key  militant 
Islamie  eause.^  Furthermore,  Bosniaks  reeeived  support  throughout  and  after  the  war. 
Various  kinds  of  assistance,  ineluding  financial  aid,  was  provided  by  Islamic  charities 
and  organizations  serving  conveniently  as  fronts  for  A1  Qaeda  to  plan  further  attacks  in 
Bosnia  and  elsewhere,  As  a  result  of  a  radical  Islamic  presence  in  the  Balkans,  the  U.S. 
embassy  in  Sarajevo  as  well  as  U.S.  military  bases  in  Bosnia  have  been  targets  for 
numerous  terrorist  threats  after  9/11.11 

Bosnia’s  dangerously  loose  internal  and  border  security,  in  addition  to  high  crime 
rates  in  Albania  in  the  1990s,  produeed  an  environment  eonducive  for  foreign  Islamic 
extremists.  12  Islamie  non-government  organizations,  some  of  which  were  fronts  for  A1 
Qaeda,  were  established  there  after  1991.  They  participated  in  the  organized  attack  on  the 
U.S.  embassy  in  Tirana  in  1998,  resulting  in  the  arrests  of  several  A1  Qaeda  members,  i* 


Shay,  Islamic  Terror  and  the  Balkans,  introduction. 

6.  Woehrel,  Islamic  Terrorism  and  the  Balkans,  3. 

7.  Shay,  Islamic  Terror  and  the  Balkans,  introduction. 

8.  Woehrel,  Islamic  Terrorism  and  the  Balkans,  3. 

9.  Ibid. 

10.  Ibid. 

11.  Ibid. 

12.  Ibid. 

13-  Ibid. 
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The  involvement  of  Islamic  terror  organizations  in  Kosovo  began  in  1998  through 
the  contribution  of  established  terror  organizations  in  Bosnia  and  Albania,  They 
operated  in  two  main  ways  by  first  establishing  a  network  of  charities  serving  as  financial 
support,  and  secondly  by  incorporating  fighters  in  combat  units  alongside  the  Kosovo 
Liberation  Army  (KLA).!^  Similar  to  the  conflict  in  Bosnia,  Islamic  charities  in  Kosovo 
served  as  a  channel  for  transferring  financial  aid  to  the  Muslims  in  Kosovo,  and  as  a 
cover  for  terrorist  activities.!^  Also,  during  the  war  in  Kosovo,  evidence  indicates  that 
“Islamic  instructors”  arrived  in  Kosovo  in  1998  from  Bosnia,  and  that  members  of  other 
terror  organizations  (e.g.,  A1  Qaeda,  the  Yemenite  organization,  the  Egyptian  Islamic 
Jihad)  participated  in  the  fight  together  with  KLA.  There  is  evidence  that  these  foreign 
volunteers  operated  not  only  in  Kosovo,  but  also  helped  the  separatist  Islamic  terror 
organizations  in  Macedonia.!* 

Macedonia,  a  country  mainly  divided  between  Muslim  Albanians  (30  percent  of 
the  population)  and  Orthodox  Christians  can  be  considered  as  another  suitable  area  for 
the  spread  of  the  ideas  and  movements  of  radical  Islam  in  the  Balkans.  !9  Due  to  its 
internal  problems  created  by  the  combination  of  ethnic  and  religious  disputes,  its 
economy,  and  its  political  weaknesses,  Macedonia  has  become  a  country  that  is 
significantly  influenced  by  outside  players  such  as  Albania  and  Muslims  in  Kosovo. 20 
The  first  evidence  of  radical  Islam  in  Macedonia  was  the  arrest  of  a  terrorist  (with 
Mujahidin  rank),  who  attempted  to  detonate  an  explosive  device  in  a  police  station  in 
Skopje  in  1999.2!  In  subsequent  years,  other  evidence  in  Macedonia  surfaced  showing 


!^-  Shay,  Islamic  Terror  and  the  Balkans,  88. 
!5-  Ibid. 

!0-  Ibid.,  89. 

!  2- Ibid. 

!*■  Ibid.,  90. 

!9-Ibid.,  1 12. 

20-  Ibid. 

21.  Ibid.,  113. 


3 


that  some  organizations  and  charities  have  provided  significant  support  for  the  creation  of 
radical  Islam  in  terms  of  manpower  (Mujahidin),  weapons,  and  funding.  22 

2.  Emergence  of  Criminalization 

From  an  organized  crime  perspective,  the  Balkans  can  be  characterized  as  a 
suitable  region  for  the  trafficking  of  weapons,  drugs,  and  people.  The  criminalization 
process  in  the  Balkans  can  be  described  as  a  result  of  two  basic  conditions:  23 

•  The  wars  in  the  former  Yugoslavia  led  to  a  high  level  of  poverty, 
corruption  and  a  low  level  of  foreign  investments; 

•  Countries  in  the  Balkans  are  a  “bridge”  to  illegal  ties  connecting  Europe 
with  Asia  and  Africa,  due  to  the  weak  border  control  implemented  by 
weak  governments. 

The  economies  of  the  countries  in  the  Balkans  can  be  characterized  as  some  of  the 
worst  economies  in  Europe. 24  This  poor  economic  environment,  connected  with 
continuing  ethnic  hatred,  has  led  some  people  to  join  existing  criminal  organizations. 25 
Exemplified  by  Max  Weber’s  “loss  of  the  monopoly  over  power,”  different  armed  groups 
or  criminals  have  penetrated  government  structures  in  these  countries  to  influence  others 
to  achieve  their  own  purposes. 26  The  inefficiency  of  governments  and  law  enforcement 
institutions  in  terms  of  low  detection  or  proper  prosecution  of  criminals  has  led  to  weak 
border  control. 22  As  a  result  of  these  economic  and  political  weaknesses,  the  Balkans  has 
become  an  ideal  location  “for  the  purchase  and  sale  of  illicit  goods,  including  weapons, 
and  transit  for  terrorists  and  their  recruiters. ”28 


22.  Shay,  Islamic  Terror  and  the  Balkans,  113. 

23.  Sheila  Rom,  “Instability  and  Desperation:  The  Balkan  Link  to  Terrorism,”  Global  Security 
Studies  1,  no.  3  (Fall  2010):  101-110. 

24.  According  to  the  CIA  Factbook,  Kosovo  has  the  worst  economy  in  Europe,  with  the  highest 
unemployment  rate,  as  the  Bosnian  national  GDP  decreased  significantly  during  the  war.  Rom,  “Instability 
and  Desperation.” 

25.  Rom,  “Instability  and  Desperation.” 

26.  Shay,  Islamic  Terror  and  the  Balkans,  88. 

27.  Rom,  “Instability  and  Desperation.” 

28.  Ibid. 
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To  summarize,  although  there  have  been  efforts  to  stabilize  security  in  these 
countries  over  the  last  ten  years,  the  Balkans  still  must  be  considered  as  an  area  of  great 
interest  to  international  terrorist  structures.  As  Shaul  Shay  states,  “the  terror  infrastructure 
and  radical  Islam  in  the  Balkans  pose  a  threat,  not  only  to  stability  in  the  Balkans,  but 
constitute  a  danger  of  subversion  and  terror  throughout  the  European  continent  and 
beyond  it.  ”29 

B,  RADICAL  ISLAM  AND  TERRORISM  IN  BULGARIA 

In  recent  years,  some  research  has  claimed  that  Bulgaria  is  not  directly  threatened 
by  terrorists  or  Islamic  fundamentalists.  20  According  to  this  research,  moderate  Islam  as 
well  as  amity  amongst  different  ethnic  and  religious  groups  exists  without  jihad. 21 
However,  Bulgaria  is  an  integral  part  of  the  Balkans  and  is  not  an  exception  to  the  threat 
of  terror  and  criminality  the  region  faces. 22  In  late  1995,  for  example,  there  is  evidence 
indicating  that  after  the  Dayton  Accords,  Ayman  al-Zawahiri  moved  Al-Qaida 
headquarters  in  the  Balkans  from  Bosnia-Herzegovina  to  a  Sofia  suburb  in  Bulgaria.  22  In 
mid-November  1995,  about  20  senior  Islamist  commanders  met  to  discuss  “the  new  wave 
of  operation  in  the  aftermath  of  Fuad  Talat  Qassim’s  August  arrest  in  Zagreb  and 
extradition  to  Cairo, 24  where  he  was  tortured  and  likely  executed.  On  November  20, 
1995,  these  Islamists  “announced”  the  emergence  of  their  center  in  Bulgaria,  sending  a 
gunman  to  open  lire  on  the  Egyptian  Embassy — a  reminder  to  the  Egyptian  government 
not  to  look  too  closely  at  the  Islamists’  activities  in  Sofia.”25  In  the  beginning  of  1996, 


29.  Shay,  Islamic  Terror  and  the  Balkans,  170. 

30.  Prodanov,  Risks  for  Bulgaria  of  Islamic  Fundamentalism  and  Terrorism,  92. 

31.  Ibid. 

32.  Bulgarian  Government  website,  “Bulgarian  National  Counterterrorism  Plan,  2008,” 
http://www.strategy.bg/StrategieDoeuments/View.aspx?lang=bg-BG&Id=497 

33.  Yossef  Bodansky,  Bin  Laden,  the  Man  Who  Declared  War  on  America  (Roekbn,  CA:  Prima 
Publishing,  1999),  155. 

34.  Aeeording  to  Bodansky:  “Qassim  was  one  of  Zawahiri’s  elosest  personal  friends,  and  his  1995 
extradition  to  Egypt  had  been  a  festering  wound.” 

35.  Bodansky,  Bin  Laden,  the  Man  Who  Declared  War  on  America,  155. 
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Zawahiri  found  Bulgaria  as  safe  place  for  his  activities;  he  organized  travel  for  42 
Egyptian  activists  to  Bulgaria  in  order  to  conduct  attacks  against  Western  targets.  ^6 

As  early  as  1992,  Bulgaria  fell  among  the  countries  and  territories  facing  radical 
Islamists  who  have  undergone  jihad — training  or  experience  in  real  battles. 37  Currently, 
there  is  a  trial  against  13  Muslim  clerics  who  are  accused  of  preaching  radical  Islam,  anti¬ 
democratic  ideology,  as  well  as  provoking  religious  hatred. 38  Some  of  the  clerics  are 
accused  of  membership  in  the  Islamist  Foundation  Organization  A1  Waqf  al  Islam!  where 
registration  as  a  religious  group  has  been  denied  in  Bulgaria.  39  According  to  Alex 
Alexiev,  the  link  with  Al  Waqf  al  Islami'^o  clearest  factor  to  judge  that  the 

defendants  are  radical  Islamists,  because  “its  leadership  has  well-proven  links  not  only 
with  Islamist,  but  also  with  terrorist  circles. ”^1  He  also  noted  that  the  money  the  imams  in 
Bulgaria  have  generated  should  not  be  underestimated  and  the  fight  against  radical  Islam 
must  start  by  tracing  the  “enormous  funds”  that  finance  Muslim  centers  in  the  country. "^2 

On  July  18,  2012,  in  Burgas  Airport  in  Bulgaria,  a  terrorist  attack  was  carried  out 
against  a  bus  with  42  Israeli  tourists. ^3  This  attack  resulted  in  five  Israelis  killed  as  well 
as  the  Bulgarian  bus  driver  and  32  injured.^^  According  to  Alex  Alexiev,  Bulgaria  is 
threatened  by  radical  Islam  because  “our  country  is  also  seen  as  part  of  the  Western 
world  as  well  as  part  of  unbelievers  who  must  be  destroyed.”45 


36.  Shay,  Islamic  Terror  and  the  Balkans,  142. 

37.  Prodanov,  Risks  for  Bulgaria  of  Islamic  Fundamentalism  and  Terrorism,  15. 

38.  News.bg,  “The  Trial  Against  the  Imams  Continues”  (2013),  accessed  June  10,  2013, 
http  ://news.ibox.bg/news/id_28 1519771 

39.  Ibid. 

40.  “This  is  one  Wahhabis  organization,  financed  by  Saudi  in  Eindhoven,  The  Netherlands.  Its 
mosque,  Al  Furqaan,  is  widely  known  as  a  center  of  propaganda  and  funding  of  religious  extremism  in  the 
whole  Europe.” 

41.  Alex  Alexiev,  “Radical  Islam  Has  Occurred  throughout  Bulgaria,”  OFFNews.bg,  December  2012, 
http://offnews.bg/index.php/132029/aleks-aleksiev-radikalen-islyam-sheta-v-balgariya. 

42.  Ibid. 

‘^3-  Wikipedia,  “Burgas  Bus  Bombing,”  2012,  http://en.Wikipedia.org/wiki/2012_Burgas_bus_bombing 

44.  Ibid. 

45.  Alexiev,  “Radical  Islam  Has  Occurred  throughout  Bulgaria.” 
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C.  FOUNDATION  FOR  CURRENT  COUNTERTERRORISM  STRATEGY 

FOR  BULGARIA 

As  a  member  of  the  European  Union  and  the  Euro-Atlantic  structures,  particularly 
in  NATO,  the  Republic  of  Bulgaria  has  entered  into  the  scope  of  geostrategic  interests  of 
Islamic  fundamentalism.  The  Bulgarian  counterterrorism  strategy,  therefore,  must  factor 
in  a  number  of  issuesA^ 

•  Bulgaria  is  geographically  located  in  the  immediate  vicinity  of  the  Islamic 
world  as  it  connects  Muslim  countries  from  Asia  with  Europe; 

•  Bulgaria  has  a  significant  number  of  Muslim  populations  with  historical 
roots  and  ethnic  consciousness,  mainly  from  Bulgarian,  Turkish  and 
Romani  origin  (in  2001,  Muslims  comprised  12.2  percent  of  the 
population  of  Bulgaria). 

•  Bulgaria  is  an  eastern  border  of  the  Europe  Union; 

•  There  is  the  presence  in  the  country  of  individual  supporters  of  terrorist 
organizations  and  their  radical  formation,  as  well  as  their  political  and  the 
religious  beliefs; 

•  As  a  member  of  NATO,  Bulgaria  participates  and  continues  to  participate 
in  the  existing  peacekeeping  missions  not  only  in  the  Balkans,  but  also  in 
Afghanistan,  Iraq,  Lebanon,  etc.^^ 

•  Activities  of  religious  foundations  and  other  non-governmental 
organizations  among  the  Bulgarian  Muslim  community  aim  to  consolidate 
extreme  forms  of  Islam; 

•  The  internal  criminal  contingent  in  Bulgaria,  and  more  specifically 
organized  crime,  has  possible  links  with  terrorist  structures; 

•  The  main  financial  support  for  the  spread  of  radical  Islam  comes  from 
petrol-rich  countries  from  the  Middle  East  which  have  a  huge  role  for  the 
dissemination  of  radical  Islam. 

Bulgaria,  an  ally  of  the  United  States  in  NATO,  actively  participates  in  military 
missions  and  operations  for  supporting  world  peace  and  in  combat  against  international 
terrorism.  In  addition,  as  a  member  of  the  European  Union,  the  country  actively  adheres 
to  the  policy  and  strategies  of  the  Union  in  its  anti-crime  and  counterterrorism  fight. 


46.  Bulgarian  Government  website,  “Bulgarian  National  Counterterrorism  Plan,  2008,” 
littp://www.strategy.bg/StrategicDocuments/View.aspx?lang=bg-BG&Id=497. 

47.  Ministry  of  Defense  of  Republic  Bulgaria  website,  “Missions  and  Operations,” 
http://www.mod.bg/bg/tema_MissionsOperations.html. 

48.  Alexiev,  “Radical  Islam  Has  Occurred  throughout  Bulgaria.” 
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According  to  the  National  Counterterrorism  Plan,  speeifie  elements  of  Bulgarian  foreign 
poliey  are: 

•  The  interaetion  of  Bulgaria  with  the  partners  of  the  European  Union  and 
NATO  allies  in  joint  fight  against  terrorism; 

•  The  eoordination,  within  the  framework  of  the  European  Union,  a 
eommon  poliey  in  the  fight  against  terrorism  in  third  eountries  and  within 
the  framework  of  international  organizations; 

•  The  implementation  of  the  European  Union  strategy  to  eombat  terrorism 
and  all  its  updates  effeetive  eontrol  of  radiealization  and  prevention  of 
terror  reeruitment  networks,  proteetion  of  eritieal  infrastrueture  sites, 
interseetion  of  ehannels  and  the  meehanisms  for  the  finaneing  of  terrorist 
aetivities,  and  prevention  of  the  use  of  the  Internet  for  terrorist  purposes; 

•  Bulgaria’s  eooperation  with  the  Couneil  of  Europe  and  Organization  for 
Seeurity  and  Co-operation  in  Europe  (OSCE);  the  ratifieation  of  the 
European  Convention  for  the  suppression  of  terrorism  and  the  Convention 
for  the  prevention  of  terrorism,  and  the  Convention  against  terrorism 
finaneing; 

•  Bulgaria’s  eontribution,  together  with  NATO  allies  and  other  partners,  to 
NATO  missions  in  different  eountries  for  reeovery  of  statehood,  validation 
of  demoeraey  and  eounteraeting  terrorist  attempts  made  to  destabilize 
soeieties  in  these  eountries; 

•  Global  planning  of  Bulgaria’s  efforts  direeted  at  implementation  of  the 
UN  Seeurity  CouneiTs  resolution  to  eombat  terrorism; 

At  the  national  politieal  level,  eoordination  of  the  aetivities  in  the  fight  against 
terrorism  is  earried  out  by  the  Couneil  for  Seeurity  at  the  Couneil  of  Ministers,  whieh 
organizes  and  eoordinates  the  aetivities  of  the  ministries  and  departments  in  eonneetion 
with  national  seeurity  ineluding  the  fight  against  terrorism, 

At  the  operational  level  in  the  fight  against  terrorism,  the  Coordinating  Center  for 
Countering  International  Terrorism  (CCCIT)  in  the  National  Seeurity  State  Ageney 
(DANS)  funetions  as  a  national  eoordinator  on  the  eombat  against  terrorism.^i  CCCIT 
implements  interaetion  with  other  struetures  involved  in  the  fight  against  terrorism, 
speoifieally  seeurity  struetures  in  the  eountry  as  well  as  with  the  speeial  foreign  serviees. 


49.  Bulgarian  Government  website,  “Bulgarian  National  Counterterrorism  Plan,  2008.” 

50-  Ibid. 

51-  Ibid. 
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and  it  centralizes  all  reeeived  operational  and  technical  information. ^2  Also,  the 
Coordinating  Center  carries  out  a  systematic  analysis  of  the  risk  of  terrorist  threats 
(including  threats  resulting  from  activities  of  Islamic  radical  groups)  and  formulates 
synthesized  and  prognostic  data.^^ 

D,  PURPOSE  OF  THESIS:  DEVELOPMENT  OF  COUNTERTERRORISM 

STRATEGIES  FOR  BULGARIA 

This  thesis  derives  potential  strategies  that  Bulgaria  could  use  to  fight  terrorist 
networks  operating  not  only  in  its  territory,  but  also  in  the  entire  area  in  the  Balkans. 
These  strategies  are  derived  from  new  methods  for  eolleeting  and  analyzing  data  on 
terrorist  networks.  However,  the  data-driven  strategies  only  serve  as  a  demonstration  of 
what  eould  be  done,  not  what  should  be  done.  Until  data  on  Bulgarian  terrorism  ean  be 
updated  and  integrated  with  classified  documents,  the  results  should  not  be  taken  as  a 
recommendation  for  current  action. 

E.  THESIS  STRUCTURE 

Chapter  II  reviews  the  literature  on  counterterror  strategies.  This  chapter  outlines 
military  strategies  (both  kinetic  and  non-kinetic)  as  well  as  non-military  strategies,  sueh 
as  law  enforeement  activities,  amnesty  programs,  development,  and  financial 
interventions. 

Chapter  III  summarizes  the  thesis  methodology.  The  data  used  for  analyzing 
networks  is  eolleeted  from  open-source  documents.  It  eonsists  of  people  affiliated  with 
terrorist  groups  in  the  Balkans,  their  activities  and  their  conneetions  with  criminal 
organizations  in  the  region.  Onee  eolleeted,  the  data  are  uploaded  into  Palantir  for  eoding 
and  strueturing.  After  some  initial  analysis,  the  data  are  exported  to  additional  software 
packages  to  conduct  in-depth  geospatial,  temporal,  link  and  social  network  analysis. 


^2-  Bulgarian  government  website,  “Bulgarian  National  Counterterrorism  Plan,  2008.” 
53  Ibid. 
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Chapter  IV  presents  the  results  of  the  data  analysis.  The  chapter  begins  with 
results  from  geospatial  and  temporal  analysis.  It  then  transitions  to  link  analysis  and 
culminates  in  social  network  analysis. 

Chapter  V  discusses  the  results  of  the  analyses.  It  then  identifies  three  alternative 
strategies  to  disrupt  the  Balkan  networks.  Based  on  a  comparative  analysis,  one  strategy 
is  recommended  to  counter  terrorism  in  the  Balkans. 

Chapter  VI  concludes  the  thesis,  summarizes  the  findings  and  recommendations, 
and  recommends  follow-on  research. 
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II.  LITERATURE  REVIEW  OF  COUNTERTERRORISM 

STRATEGIES 


Three  deeades  ago,  terrorists  wanted  to  elieit  publie  sympathy  in  order  to  aehieve 
their  ideology-motivated  goals.  After  the  Cold  War,  the  number  of  terror  attaeks 
significantly  increased.  Terrorism  also  has  changed  its  form  and  nature  and  now  is 
directed  “against  civilians,  not  governments  or  their  institutions”  in  order  to  achieve  its 
political  and  economic  goals. The  process  of  globalization  led  to  the  establishment  of 
“network-centric  terror  organizations.”^^  Their  objectives  have  broadened  by  the 
expansion  of  their  activities  and  include  the  distribution  of  the  world’s  resources  and  the 
destruction  of  Western  countries  mainly  by  threatening  human  security.  Terrorists  have 
evolved  in  their  abilities  to  use  the  new  technologies  and  in  their  tactics;  they  are  well 
trained  and  equipped;  often  they  rely  on  criminal  and  illegal  activities. As  a  result  they 
have  been  able  to  achieve  mass  casualty  attacks  throughout  the  world,  such  as  attacks  of 
September  11,  London  bombing,  and  Madrid  bombing. 

Today  there  is  not  a  single  strategy  to  combat  terrorism,  or  a  common  theory  of 
anti-terrorists  operations,  because  a  strategy  can  be  effective  in  the  fight  with  a  particular 
terror  group,  operating  in  a  particular  region,  but  it  might  not  work  against  another  one.^^ 
Consequently,  a  strategy  has  to  be  based  on  both  “particularly  the  nature  of  the 
government  under  attack  and  the  most  important  operational  features  of  the  relevant 


54  .  Mikhail  Rykhtik,  “Asymmetric  Threats  and  Counter-Terrorism  Strategies  in  Russia,”  in  National 
Counter-Terrorism  Strategies:  Legal,  Institutional,  and  Public  Policies  Dimensions  in  the  U.S.,  UK, 
France,  Turkey,  and  Russia,  ed.  Robert  Orttung  and  Audrey  Makarychev  (Washington,  DC:  The  NATO 
Programme  for  Security  through  Science:  lOS  Press,  2006),  167. 

55.  Rykhtik,  “Asymmetric  Threats  and  Counter-Terrorism  Strategies  in  Russia,”  167. 

56.  Ibid. 

57.  Ibid. 

58.  Ibid. 

59.  Kurt  Campbell  and  Richard  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism: 
Lessons  Learned  from  Past  Counterinsurgencies  (Princeton,  NJ:  Princeton  University  Press,  2006). 
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terrorist  groups.”^*’  As  a  result,  for  the  purpose  of  this  approaeh  we  separate  general 
eounterterrorism  strategies  into  two  main  groups:  military  strategies  and  non-military 
strategies. 

A,  MILITARY  STRATEGIES 

There  are  various  eenters  for  eolleeting  and  analyzing  data  about  “dark  networks 
i.e.,  illegal  and  eovert  networks.”^'  Although  mueh  attention  has  been  paid  to  the 
eolleetion  of  data  eonneeted  with  dark  networks,  there  are  not  so  many  sourees  exploring 
and  comparing  strategies  for  disruption  of  these  networks  in  terms  of  “balancing  their 
potential  gains  with  their  likely  potential  costs.”  Furthermore,  focusing  on  capturing 
and  eliminating  “designated  high  value  targets”  is  not  a  silver  bullet,  because  as  General 
Flynn  and  his  coauthors  have  claimed,  “merely  killing  insurgents  usually  serves  to 
multiply  enemies  rather  than  subtract  them.”  Consequently,  strategies  focused  on 
population  also  have  to  be  considered. To  provide  some  coherence  among  the  different 
military  strategies,  Roberts  and  Everton  (2011)^^  offered  a  framework  that  organized 
generic  strategies  into  two  main  types:  Kinetic  and  Non-kinetic.^^  The  former  is  based 
on  force  measures  to  “eliminate  or  capture  network  members  and  their  supporters  and 
employs  the  usage  of  bombs  and  bullets  to  pursue  the  campaign.”^^  The  latter  is  not 
based  on  “bombs  and  bullets”  but  rather  applies  non-coercive  means  to  neutralize  dark 
networks,  such  as  “the  reconstruction  of  war-torn  areas,  intelligence,  and  psychological 
operations.”®^ 

60.  Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons  Learned 
from  Past  Counterinsurgencies. 

61.  Nancy  Roberts  and  Sean  Everton,  “Strategies  for  Combating  Dark  Networks,”  Journal  of  Social 
Structure  12  (2011):  2,  www.cmu.edu/joss/content/articles/volumel2/RobertsEverton.pdf 

62.  Ibid. 

63.  Ibid.,  3. 

64.  Ibid. 

65.  Since  the  rehabilitation  strategy  of  the  Roberts  and  Everton  structure  of  strategies  is  not  military,  I 
removed  it  to  the  non-military  strategies  section  of  this  chapter. 

66.  Roberts  and  Everton,  “Strategies  for  Combating  Dark  Networks,”  3. 

67.  Ibid. 

68.  Ibid. 
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The  kinetic  strategies  are  aggressive  actions  aimed  at  neutralizing,  capturing  or 
eliminating  terrorists  and  their  supporters  by  removing  key  actors  in  a  network,  or  by 
disrupting  “key  ties  or  links  among  individuals,  groups  or  organizations.” ^9  Based  on 
that,  Roberts  and  Everton  divide  kinetic  strategies  into  targeting  and  capacity-building 
strategies. former  can  be  conducted  in  three  ways:  Person-Targeting  (“man-hunting 
operations”),  Group-Targeting  (operations  concentrated  on  teams,  groups,  or  subsets  of  a 
particular  terror  network)  and  Organization-Targeting  (operations  focused  on  an  entire 
terror  organization).^!  The  latter  is  focused  on  “training  and  advising  host-nation  security 
forces  to  become  a  professional  force. ”^2 

The  Non-kinetic  strategy,  in  turn,  involves  less  aggressive  means  aimed  to 
undermine  terror  networks  “more  with  the  diplomatic  and  economic  tools  of  national 
power  than  with  the  military  forces. ”^3  There  are  different  means  for  leading  this 
strategy,  which  can  be  allied  for  the  purpose  of  this  thesis  and  are  as  follows: 

•  Institution-Building  strategy  uses  “Civil  Affairs  forces  that  provide 
humanitarian  and  civic”  support  for  reconstruction  of  the  countries  after 
the  war  (Bosnia  and  Herzegovina,  Kosovo,  etc.),  which  can  be  achieved 
by  “building  healthy  host-government  institutions  of  governance,  rule  of 
law,  and  economic  development.”24 

•  Psychological  Operations  practice  the  dissemination  of  information  for 
influencing  the  behavior  of  population  of  a  country,  counterterrorist 
propaganda  in  terms  of  spreading  “disaffection  and  dissidence  among 
adversaries  to  reduce  their  will  to  fight  and  ultimately  to  induce  their 

surrender.”25 


Roberts  and  Everton,  “Strategies  for  Combating  Dark  Networks,”  4. 

20-  Ibid. 

21-  Ibid. 

22-  Ibid. 

23-  Ibid. 

24-  Ibid.,  5. 

25-  Ibid.,  6. 
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•  Information  Operations  are  based  on  “eleetronie  warfare  and  eomputer 
network  operations  to  eombat  terrorism.”^^  The  former  is  used  “to  eontrol 
the  eleetromagnetie  speetrum  or  to  attaek  the  adversary. The  latter  is 
used  for  supporting  military  operations  to  eontrol  networked  eomputers 
and  IT  systems.  Both  operations  ean  be  used  “to  attaek,  deeeive,  degrade, 
and  disrupt  information  operations  eapabilities  and  to  deny,  exploit,  and 
defend  eleetronie  information  and  infrastrueture.”^^ 

Both  generie  approaehes  ean  be  applied  to  a  eountry  or  a  group  outside  one’s 
borders. "79  por  an  example,  Bulgaria  eould  pursue  both  approaehes  toward  disrupting 
terrorist  networks  that  operate  within  its  territory  and  outside  its  borders  in  neighboring 
eountries  (e.g.,  the  Balkans).  These  strategies  also  ean  be  pursued  with  other  eountries. 
Furthermore,  the  Kinetie  and  Non-kinetie  approaehes  to  eountering  terrorism  ean  be 
developed  using  soeial  network  analysis  to  highlight  terrorist  networks. 

B,  NONMILITARY  STRATEGIES 

Although,  the  use  of  military  foree  has  an  essential  role  in  the  fight  against 
terrorism,^!  Ami  Pedahzur  argues  that  “the  war  model,”  eondueted  not  only  by  Israel  but 
also  by  other  eountries  for  eombating  terrorism,  is  “flawed  not  only  beeause  it 
undermines  eivil  liberties,  as  many  have  argued  in  the  past,  but  also  beeause  it  is 
unsuitable  for  the  ehallenges  of  terrorism  and  causes  the  security  establishment  to  deviate 
from  dealing  with  other,  more  imminent  threats.”  He  recommends  that  politicians 
should  consider  the  fact  that  the  terrorism  is  a  form  of  “psychological  warfare”  led  by 
paramilitary  forces,  and  as  a  result  counterterror  strategies  should  be  transformed  in  a 
“defensive  model.”  In  addition,  in  order  to  address  terrorism  adequately  governments 


Roberts  and  Everton,  “Strategies  for  Combating  Dark  Networks, ”6. 

77-  Ibid. 

78-  Ibid. 

79-  Ibid. 

80-  Ibid.,  7. 

81-  William  C.  Banks,  Renee  de  Nevers,  and  Mitehel  B.  Wallerstein,  Combating  Terrorism,  Strategies 
and  Approaches  (Washington,  DC:  CQ  Press,  2008),  327. 

82-  Ami  Pedahzur,  The  Israeli  Secret  Services  &  the  Struggle  against  Terrorism  (New  York:  Columbia 
University  Press,  2010),  135. 

83-  Pedahzur,  The  Israeli  Secret  Services  &  the  Struggle  against  Terrorism,  144. 
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need  to  “understand  the  role  of  non-state  aetors,  including  criminals,  as  a  threat  to  state 
security,”  because  “criminals  and  terrorists  intersect  in  many  ways.”  As  a  result,  non¬ 
military  approaches  should  be  considered  as  well.  They  can  be  achieved  by: 

•  law  enforcement 

•  amnesty  program 

•  winning  public  support 

•  development  strategy 

•  financial  strategy 

1,  Law  Enforcement 

As  the  senior  UN  official  in  Kosovo  Bernard  Kouchner  said,  “The  lesson  of 
Kosovo  was  that  peacekeeping  missions  need  to  arrive  with  a  law-and-order  kit  made  up 

of  trained  police,  judges,  and  prosecutors  and  a  set  of  draconian  security  laws.  This  is  the 

86 

only  way  to  stop  criminal  behavior  from  flourishing  in  a  vacuum  of  authority.” 
Statistically,  regarding  the  effectiveness  of  law  enforcement  “as  of  mid-2003,  the  police 
in  over  100  countries  had  arrested  more  than  3,000  suspects  linked  to  al  -Qaeda,  while 
the  military  had  captured  only  650  enemy  combatants.”*^  Police,  unlike  soldiers,  are  the 
main  link  between  a  local  population  and  the  government  security  institutions,  and 
usually  provoke  less  stress  when  applying  their  tactics — regular  patrols,  surveillance, 
patient  observation,  establishing  a  bond  with  the  community  leadership,  tracking  terror 
networks  and  individuals,  information  gathering  about  terrorists  rather  than  the  use  of 
soldiers  with  their  “search-and-destroy”  or  mass  detention  operations.  Another 
important  function  of  law  enforcement  is  to  “disrupt  terrorist  financing  that  includes  by 
uncovering  links  between  terrorists  and  organized  criminal  groups.  Many  modem 

Louise  Shelley,  “Countering  Terrorism  in  the  U.S.:  The  Fallaey  of  Ignoring  the  Crime — Terror 
Nexus,”  in  National  Counter-Terrorism  Strategies:  Legal,  Institutional,  and  Public  Policies  Dimensions  in 
the  U.S.,  UK,  France,  Turkey,  and  Russia,  ed.  Robert  Orttung  and  Audrey  Makaryehev  (Washington,  DC: 
The  NATO  Programme  for  Seeurity  through  Seienee:  lOS  Press,  2006),  212. 

■  Shelley,  ^"Countering  Terrorism  in  the  US. :  The  Fallacy  of  Ignoring  the  Crime  -  Terror  Nexus,  ” 

203. 

*6- Ibid.,  210. 

Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons  Learned 
from  Past  Counterinsurgencies. 

**•  Ibid. 
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terrorist  groups,  like  some  insurgents,  derive  substantial  funds  from  nareoties  trafficking 
and  other  illicit  activities.”  Furthermore,  the  deterrence  effect  of  law  enforcement  could 
be  a  useful  tool  to  combat  terrorism  by  demonstrating  that  the  government  under  attack  is 
able  to  judge  suspected  terrorists,  or  to  prevent  others  from  joining  to  terrorism.90  In 
addition,  law  enforcement  can  be  used  to  reduce  terrorist  recruitment  by  disrupting  places 
where  such  activities  occur,  This  can  be  achieved  by  monitoring  and/or  closing  radical 
mosques  and  schools;^^  for  instance,  in  France  police  and  security  services  have  an 
access  to  all  kinds  of  data  and  can  use  all  forms  of  interception,  physical  surveillance, 
monitoring  of  speeches,  sermons  and  literature  from  Salafist  mosques,  and  other  Islamic 
fundamentalist  activities  in  the  country,  which  have  resulted  in  the  arrests  of  dozens 
Islamic  fundamentalists. 

2.  Amnesty  Programs 

This  counterterrorism  strategy  is  expressed  by  dividing  a  terrorist  group  into 
subgroups. This  can  be  achieved  by  amnesty  programs  (that  encourage  defections 
among  terrorists),  division  of  a  group  into  different  ethnic,  tribes  and  national 
components,  if  it  consists  of  such,  and  empowering  Islamic  moderates,  etc.^^  Also, 
rehabilitation  can  be  used  to  influence  “moderate  preachers  to  counsel  terrorists  and  to 
instill  in  them  a  more  balanced  view  of  Islamic  teaching. ”96 


89.  Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons  Learned 
from  Past  Counterinsurgencies. 

90.  Banks,  Combating  Terrorism,  Strategies  and  Approaches,  138. 

91.  Lynn  E.  Davis  and  Melanie  W.  Sisson,  A  Strategic  Planning  Approach:  Defining  Alternative 
Counterterrorism  Strategies  as  an  Illustration  (Santa  Monica,  CA:  RAND  Corporation,  2009),  12. 

92.  Davis  and  Sisson,  A  Strategic  Planning  Approach:  Defining  Alternative  Counterterrorism 
Strategies  as  an  Illustration,  12. 

93.  Gary  J.  Schmitt,  “France:  In  a  League  of  Its  Own,”  in  Safety,  Liberty,  and  Islamist  Terrorism: 
American  and  European  Approaches  to  Domestic  Counterterrorism,  ed.  Gary  J.  Schmitt  (Washington,  DC: 
TheAEI  Press,  2010),  111. 

94.  Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons  Learned 
from  Past  Counterinsurgencies. 

95.  Ibid. 

96.  Roberts  and  Everton,  “Strategies  for  Combating  Dark  Networks,”  6. 
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3,  Winning  Public  Support 

In  many  cases,  most  terrorists  and  insurgents  are  dependent  on  the  population  not 
only  for  logistical  support  in  the  sense  of  information,  food,  shelters,  but  also  for 
employing  reeruits.  As  a  result,  winning  public  support  is  an  important  strategy  for  both 
host  and  foreign  countries  in  order  to  reduce  terrorist  activities,  although  it  would  not 
have  instant  effeet.^s  This  strategy  ean  be  accomplished  through  different  campaigns, 
such  as:^^ 

•  Influence  campaigns  aimed  at  both  religious  leaders,  who  play  a  vital  role 
in  the  reeruitment  proeess  and  deliver  religious  justifieation  for 
violenee,  and  loeal  political  leaders  “in  order  to  undermine  the 
eredibility  of  religious  and  ideological  justifications  for  suicide  and  the 
killing  of  innocents  and  Muslims.”  Such  a  campaign  should  be  done  by 
earefully  and  discretely  funding  a  leader  or  a  group.  1^2 

•  Influence  eampaigns  showing  Western  values.  Eeonomic  policies  eould 
ereate  business  partnerships  with  “Muslim  business  leaders  who 
appreeiate  the  benefits  of  cooperation  with  Western  institutions”  in  order 
to  support  “moderate  Muslim  elites  as  well  as  aequiring  information  about 
their  extremist  rivals.”  1*^3  Furthermore,  eampaigns  to  infiuenee  the  broader 
Muslim  population,  for  example,  the  U.S.  disaster  relief  campaign  to 
Muslims  after  the  Deeember  2004  Asian  Pacific  Tsunami  demonstrated 
“U.S.  coneern  to  alleviate  Muslim  suffering”  and  led  to  weakening  public 
“support  for  terrorism  in  many  Muslim  countries.” 


97.  Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons  Learned 
from  Past  Counterinsurgencies. 

98Ibid. 

99Ibid. 

100.  Jarret  M.  Brachman  and  William  F.  McCants,  “Stealing  A1  Qaeda’s  Playbook,”  Studies  in 
Conflict  &  Terrorism  29,  no.  4  (2006):  5-22. 

101.  Davis  and  Sisson,  A  Strategic  Planning  Approach:  Defining  Alternative  Counterterrorism 
Strategies  as  an  Illustration,  1 1 . 

102.  Braehman  and  MeCants,  “Stealing  A1  Qaeda’s  Playbook,”  5-22. 

103.  Campbell  and  Weitz,  Non-Military  Strategies  for  Countering  Islamist  Terrorism:  Lessons 
Learned  from  Past  Counterinsurgencies. 
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•  De-legitimizing  terrorism  using  a  strategy  showing  that  genoeide,  piraey 
and  slavery  are  outeomes  of  terrorism,  which  “are  now  considered  beyond 
the  bounds  of  proper  behavior.”  Also,  it  has  to  highlight  distortion 
activities  of  Islam  extremists  and  their  sacred  principles  in  order  to 
discredit  their  propaganda  and  to  empower  moderate  Muslims.  1^6  This  can 
be  achieved  by  funding  effective  media  campaigns,  “but  in  a  very  low  key 
and  indirect  manner,”  to  turn  “Muslim  public  opinion  against  the 
jihadists”  by  “broadcasting  images  of  jihadi  attacks  that  have  killed 
Muslim  children.”^®’  Rather,  a  message  showing  that  jihadists  have  killed 
thousands  of  Muslims  and  non-Muslims  might  provoke  negative  public 
opinion  toward  terrorists, 

4.  Development  Strategy 

Since  international  terrorism  is  considered  as  a  political  act,  and  no  country  can 
overcome  it  on  its  own,  diplomatic  cooperation  between  countries  is  “the  cornerstone  of  a 
comprehensive,  long-term,  international  counterterrorism  strategy  that  seeks  to  politically 
discredit,  operationally  disrupt,  and  eventually  defeat  the  most  violent  groups.”  The 
indirect  support  of  foreign  governments  is  needed  to  fight  with  terrorists,  because  as 
defense  analysts  Steven  Metz  and  Raymond  Millen  have  noted  about  contemporary 
counterterrorism,  “the  key  to  success  is  not  for  the  U.S.  military  to  become  better  at 
counterinsurgency,  but  for  the  U.S.  military  (and  other  elements  of  government)  to  be 
skilled  at  helping  local  security  and  intelligence  forces  become  effective  at  it.”  no  As  a 
result  the  United  States,  for  example,  has  supported  friendly  governments  by 
providing  training,  intelligence  and  financial  aid  in  order  to  improve  their  counterterror 
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abilities,  m  This  type  of  U.S  government  policy  can  have  beneficial  effects  against 
terrorists,  such  as:  ^  12 

•  Improvements  in  intelligence,  law  enforcement  and  military  defense 
capability; 

•  Promotion  of  political  and  economic  reforms.  “Strengthening  secular 
education”  and  discrediting  radical  Islam  and  anti-Western  propaganda; 

•  Creation  of  a  multinational  coalition  to  combat  terrorism,  which  is  able  to 
control  WMD  proliferation  and  support  multilateral  anti-terrorism 
intelligence  sharing.  In  addition,  international  cooperation  is  significantly 
important  to  limit  the  support  from  states  to  terrorists,  and  can  be 
achieved  by  political,  moral  and  economic  pressure  on  these  states, 

5,  Financial  Strategy 

The  knowledge,  gained  from  past  counterterrorism  actions,  shows  that  any 
terrorist  group  depends  on  support  across  the  borders.  For  instance,  the  Japanese  Red 
Army  directed  such  activities  against  Israel  for  the  Palestinians.  IRA  operators  provided 
training  support  to  the  FARC  in  Columbia. Nowadays,  “not  only  is  the  al-Qaeda 
network  inherently  multinational,  but  even  terrorist  groups  that  conduct  strikes  inside  a 
single  country  rely  on  transnational  support,”! which  usually  “comes  from  some  states, 
charity  associations,  and  donations  ostensibly  for  humanitarian  purposes  that  are  then 
transferred  to  terrorists  organizations.”!!^  As  a  result,  a  strategy  for  interrupting  financial 
support  for  terrorists  is  important.!!*  This  strategy  can  be  achieved  by  decreasing  “the 
availability  of  informal  and  illegal  mechanisms  of  funds  transfer,  including  implementing 
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regulatory  mechanisms  to  monitor  charitable  donations  and  increasing  efforts  to  detect 
money  laundering,  black  market  activity,  and  drug  trade.” 


C.  SUMMARY 

International  terrorism  is  constantly  evolving  in  its  tactics  and  strategies. 
Consequently,  counterterrorism  strategies  have  to  evolve  as  well.i^o  In  order  to  develop 
an  effective  strategy,  the  first  step  is  to  collect  data  on  the  threats,  identify  groups 
responsible  for  the  threats,  and  investigate  what  behavior,  trends  and  vulnerabilities  each 
group  presents  since  different  approaches  are  needed  for  different  terror  organizations.  121 

In  selecting  a  strategy  both  military  and  nonmilitary  strategies  need  to  be 
considered,  with  the  full  understanding  that  it  is  possible  to  combine  them,  122  as  long  as 
resources  are  available.  In  addition,  any  counterterror  strategy  has  to  consider  “the 
balance  between  values  such  as  civil  liberties,  and  the  empowering  of  law  enforcement 
agencies  at  home,  as  well  as  the  balance  between  rigorous  counterterrorism  and 
international  law  abroad.”  123 

This  thesis  demonstrates  a  process  for  selecting  a  strategy  or  a  combination  of 
strategies  that  Bulgaria  could  pursue  in  order  to  fight  terrorism  in  the  Balkans.  Most 
importantly,  it  illustrates  how  a  strategy  could  emerge  from  a  careful  analysis  of  networks 
operating  over  the  last  two  decades  in  the  Balkans. 


119-  Davis  and  Sisson,  A  Strategic  Planning  Approach:  Defining  Alternative  Counterterrorism 
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III.  METHODOLOGY 


A.  INTRODUCTION 

This  chapter  describes  the  research  process  used  to  answer  the  thesis  question. 
The  proeess  eonsists  of  three  basic  steps:  data  colleetion  and  data  structuring;  data 
analysis;  strategy  development  and  strategy  selection. 

B,  NETWORK  DATA  COLLECTION  AND  DATA  STRUCTURING 

Since  Bulgaria  is  located  in  the  Balkans,  the  main  part  of  the  analysis  examines 
the  terror  networks  operating  not  only  in  the  eountry,  but  also  in  other  countries  in  the 
region.  Most  of  the  terror  networks  analyzed  in  this  approaeh  were  formed  after  the 
eollapse  of  Yugoslavia,  basically  during  the  wars  in  Kosovo,  Bosnia  and  Herzegovina 
with  a  strong  support  from  outside  the  borders  of  the  Balkans.  In  order  to  track  and 
analyze  the  evolution  of  radieal  Islamie  terrorist  organizations  operating  in  the  Balkans, 
the  first  step  was  to  colleet  the  data. 

The  eollected  data  documents  terror  events  that  oceurred  in  the  Balkans  from 
1990  to  present  day  (2013)  and  are  drawn  from  the  Global  Terrorism  Database  and  Jane’s 
database.  The  data  consist  of  about  755  events,  information  about  the  types  of  events, 
dates  of  events,  as  well  as  their  geographical  coordinates.  Geospatial  data  sets  also  were 
colleeted  from  DIVA  GIS  and  Narodov  Mira  Greg.  In  addition,  data  about  the  people  and 
organizations  connected  to  terrorist  groups  operating  in  the  Balkans  were  drawn  from 
English  and  Bulgarian  books,  news  and  journals.  All  data  was  then  uploaded  into  a 
program  ealled  Palantir  for  coding  and  structuring  necessary  to  perform  the  analysis 
deseribed  below. 
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C.  DATA  ANALYSIS 

Data  analysis  is  a  crucial  step  in  developing  a  counterterrorism  strategy  at  the 

125 

national  and  even  at  a  tactical  level.  The  latter  is  important  in  the  proeess  of  tracking 

terrorist  activities  beeause  terror  networks  rely  heavily  on  their  loeal  cells  that  operate 

126 

tightly  together  with  limited  information  of  the  larger  organization. 

Currently,  there  are  many  data  eollection  techniques  for  fighting  terrorist 
organizations.  This  thesis  uses  geospatial  analysis,  temporal  analysis,  link  analysis  and 
social  network  analysis. 

1.  Geospatial  and  Temporal  Analysis 

Two  software  packages  were  used  to  conduct  geospatial  analysis — Palantir  and 
ARC-GIX.  Palantir’ s  visualization  of  terror  events  revealed  the  pattern  of  terrorist  events 
over  time,  their  geospatial  distribution  through  time  and  their  relationship  to  the  ethnie 
distribution  in  the  Balkans. 

2.  Link  Analysis 

Link  analysis  is  a  method  of  analyzing  networks  consisting  of  different  types  of 
entities  (for  example,  people,  buildings,  cars,  locations,  events)  and  different  ties  between 
them.  In  this  ease,  Palantir  was  useful  in  creating  an  overall  picture  of  how  people  and 
organizations  are  interconneeted  by  events  and  aetivities. 

3.  Social  Network  Analysis 

After  structuring  and  conducting  the  initial  analysis  in  Palantir,  the  data  were 
exported  to  Soeial  Network  Analysis  (SNA)  programs.  In  eontrast  to  Link  Analysis,  SNA 
is  focused  on  ties  between  similar  objects  (for  example,  people,  organizations)  in  order  to 

124.  Lawrence  Cline,  “Intelligence  and  Combating  Terrorism,”  in  Fighting  Back:  What  Governments 
Can  Do  about  Terrorism,  ed.  Paul  Shemella  (Stanford,  CA:  Stanford  Security  Studies,  201 1),  193. 

125.  John  J.  Le  Beau,  “Intelligence  and  Counterterrorism:  Examining  the  Crucial  Tools  of  Secrecy  and 
Cooperation,”  in  Toward  a  Grand  Strategy  against  Terrorism,  ed.  Christopher  C.  Harmon  (New  York: 
McGraw  Hill  Companies,  2011),  195. 
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analyze  their  soeial  interaetion  patterns  and  speculate  how  these  patterns  affect  their 
behavior.  SNA  is  a  methodology  based  on  mathematics,  anthropology,  psychology  and 
sociology,  “where  individuals  are  reduced  to  nodes  and  their  relationship  to  links.”  129  in 
other  words,  SNA  is  based  on  the  assumption  that  the  “behavior  of  actors  is  profoundly 
affected  by  their  ties  to  others;  the  networks  in  which  they  are  embedded”  affect  what 
they  do,  say,  and  believe. Consequently,  SNA  provides  empirical  data  to  a  social 
context. 

There  are  a  number  of  SNA  programs.  This  research  relies  on  UCINET,  ORA, 
and  Pajek,  each  of  which  has  its  strengths  and  weaknesses.  132  UCINET  is  the  most 
popular  software  for  SNA,  because  it  comprehensively  assesses  measures  of  network 
topography,  actor  centrality,  identifies  subgroups,  and  also  “includes  tools  for  selecting 
subsets  of  files,  merging  and  stacking  datasets,”  and  allows  easy  data  export  and  import 
in  different  formats.  133  The  other  program,  Pajek,  “does  not  include  as  many  algorithms 
as  UCINET,”  however  it  can  handle  very  large  datasets  and  allows  “users  to  visualize 
networks  in  two  or  three  dimensions.”  134  Unlike  UCINET  and  Pajek,  ORA  allows  users 
to  analyze  networks  based  on  “a  report  containing  a  series  of  related  measures,”  also  the 
software  “includes  features  for  simulating  various  scenarios,  geospatially  analyzing  and 
mapping  social  networks,  and  creating  different  useful  charts. ”133  The  disadvantage  of 
ORA’s  report  -  based  approach  is  “that  sometimes  it  includes  inappropriate  metrics  for  a 
particular  network  (estimating  closeness  centrality  in  a  disconnected  network)  which  can 
lead  to  assumptions  that  some  actors  are  most  important  than  they  really  are.”  136  For 


128-  Everton,  Disrupting  Dark  Networks,  7. 

129-  Stuart  Koschade,  “A  Social  Network  Analysis  of  Jemaah  Islamiyah:  The  Applications  to 
Counterterrorism  and  Intelligence,”  in  Studies  in  Conflict  and  Terrorism  29,  no.  6,  (2006):  589-605. 

130-  Everton,  Disrupting  Dark  Networks,  7. 
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132.  Everton,  Disrupting  Dark  Networks,  49. 
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135.  Ibid.,  69. 
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23 


this  research,  UCINET  and  ORA  are  used  to  estimate  metrics  and  to  manipulate  the  data, 
while  Pajek  is  used  for  robust  visualizations  of  the  network.  137 

The  relational  data  sets  were  analyzed  by  using  different  metric  families  found  in 
the  field  of  SNA,  such  as  network  topography,  subgroups,  centrality  measures,  brokers 
and  bridges  in  the  network.  138 

4.  Data  Fusion 

The  final  part  of  data  analysis  is  data  fusion  where  all  the  results  from  different 
analysis  are  combined  and  aggregated  to  provide  a  common  operating  picture  of  terror 
networks  operating  in  the  Balkans.  This  picture  consists  of  information  about  both  central 
people  (terrorists,  politicians,  religious  leaders,  etc.)  who  are  connected  to  other  people  in 
the  network  and  central  organizations.  It  also  includes  information  about  the  location  of 
terror  events  over  the  period  from  1990  to  the  present. 

D,  STRATEGY  OPTIONS  AND  STRATEGY  SELECTION 

The  final  part  of  the  thesis  involves  strategy  development  and  strategy  selection. 
Building  on  the  fused  data,  three  potential  counterterrorism  strategies  surface  and  are 
considered.  The  selection  of  a  preferred  strategy  is  based  on  the  following  criteria: 
limitation  of  civil  liberties;  available  resources  for  implementation;  potential  threats  to 
people  and  critical  infrastructure;  limitations  of  implementation;  and  potential 
effectiveness  of  strategies.  Utilizing  the  Analytic  Hierarchy  Process  (AHP)  as  a  decision 
making  tool,  one  strategy  is  recommended  to  counter  terrorism  in  the  Balkans. 


137.  Everton,  Disrupting  Dark  Networks,  74. 

138.  Ibid.,  8-14. 
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IV.  DATA  ANALYSIS 


The  purpose  of  this  chapter  is  to  demonstrate  how  to  analyze  the  collected  and 
structured  data  about  terror  networks.  It  consists  of  four  analytical  steps:  geospatial, 
temporal,  link,  and  social  network  analysis  (SNA).  The  final  part  of  this  chapter  is  a  data 
fusion  of  all  analyses  in  order  to  create  a  common  operational  picture  1^9  about  the  modus 
operandi  of  terror  networks  operating  in  the  Balkans,  This  overview  consists  of 
information  about  the  most  important  people  (terrorists,  politicians,  religious  leaders, 
etc.)  and  terror  organizations,  in  addition  to  information  about  the  location  of  terror 
events  over  the  period  in  this  study.  Most  importantly,  it  will  inform  the  development  and 
selection  of  a  counterterrorism  strategy  in  the  next  chapter. 

The  analysis  begins  with  a  review  of  the  ethnic  distribution  in  the  Balkans 
countries.  As  can  be  seen  in  Figure  1,  the  region  consists  of  many  ethnic  groups.  In 
addition  to  ethnicity  distribution,  religion  is  spread  among  the  ethnic  groups  in  terms  of 
Orthodox  Christianity  (Serbs,  Macedonians,  and  Bulgarians),  Catholicism  (Slovenians 
and  Croatians),  and  Islam  (Bosnians,  Muslim  Bulgarians,  and  Albanians). As  a  result, 
the  Balkans  has  been  historically  regarded  as  a  “transit  area,  [a]  bridge  between  different 
cultural  worlds,  and  as  a  range  through  which  people,  ideas  and  merchandise  passed.” 


139-  Common  Operational  Picture  (COP)  offers  a  standard  overview  of  an  incident,  providing  incident 
information  that  enables  the  Incident  Commander  and  any  supporting  agencies  to  make  effective  decisions. 

Common  Operational  Picture  (ArcGIS  10),  ArcGIS, 
http://www.arcgis.com/home/item.html?id=ld90b418b78e40158914bd5178b6892f 
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ETHNIC  DISTRIBUTION  IN  THE  BALKANS 


Figure  1 .  Ethnic  distribution  in  the  Balkans.  The  image  was  created  through  the  use 

ArcGIS  software  programs. 


After  the  collapse  of  Yugoslavia  and  the  ensuing  ethnic  conflicts  in  the  Balkans, 
the  area  “became  a  focal  point  of  attraction  to  Islamic  terror  entities.”  1^5  During  the  civil 
war  in  Bosnia  and  Herzegovina  (1992-1995)  several  thousand  warriors,  mainly  Afghan 
“alumni”  and  A1  Qaida  members  arrived  there  to  fight  against  the  Serbs  and  also  to  train 
“Muslim  Bosnian  fighters. ”1^6  They  formed  Mujahidin  brigades  with  the  support  of  Ilia 
Izetbegovic — a  leader  of  Party  of  Democratic  Action  (SDA)  and  Muslim  leader  in 


Shay,  Islamic  Terror  and  the  Balkans,  xi. 
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Bosnia.  Also,  Muslims  in  Bosnia  received  significant  support  from  Iran,  After  the 
end  of  the  Bosnian  war,  although  Mujahidin  units  were  disbanded,  a  thousand  of  these 
foreign  fighters  stayed  in  Bosnia.  Their  presence  combined  with  corruption,  low 
government  power  and  weak  public  security  has  made  Bosnia  a  haven  for  criminals  and 
terrorists.  Furthermore,  Islamic  terror  influence  has  spread  into  Kosovo  and  in 
Macedonia  as  well.i^i  As  a  result,  the  Balkans  Islamic  extremist  activities  have  turned 
the  area  into  a  platform  from  which  to  threaten  global  security.  152  For  example,  there  is 
evidence  of  links  to  the  September  1 1  attacks,  the  “Millennium”  attacks  and  terrorist 
activities  in  France,  Germany,  Britain,  Spain  and  Italy.  153 

A.  TEMPORAL  ANALYSIS 

Based  on  the  Global  Terrorist  Database  (GTD)  data  set,  Palantir  visualized 
temporally  these  terror  events  committed  in  the  Balkans  from  1991-2013  (Figure  2).  The 
data  include  755  terror  events  committed  by  not  only  terrorist  organizations  but  by 
individuals.  The  majority  of  the  terror  events  were  unattributed  to  a  particular  group  and 
many  were  random  acts  of  violence  connected  with  sectarian/ethnic  conflicts.  There  is  a 
total  of  755  events — 374  bombings  (shown  in  red),  246  assault  attacks  (dark  blue),  59 
assassinations  (blue),  47  facilities  and  infrastructure  attacks,  21  hostage  kidnappings 
(Purple),  and  1  hijacking. 


14^-  Shay,  Islamic  Terror  and  the  Balkans,  xi. 

148-  Ibid. 

149-  Ibid. 

150-  Shay,  Islamic  Terror  and  the  Balkans,  xii. 

151-  Shay,  Islamic  Terror  and  the  Balkans,  xiii. 

152-  Ibid. 
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Figure  2.  Terror  events  in  the  Balkans  (1991-2013). 


As  seen  in  Figure  2,  there  were  relatively  few  violent  events  during  the  time 
period  of  the  Bosnian  War  from  1992  to  1995.  From  1991  to  1995  most  of  the  events 
oeeurred  in  Bosnia,  where  over  100,000  civilians  and  soldiers  were  killed.  Consequently, 
El  Mujahedeen  terrorist  activities  were  not  part  of  the  data  since  they  were  officially  part 
of  the  Muslim  Bosnian  Army  until  they  were  forced  to  disband  in  accordance  with  the 
Dayton  Peace  Accords  in  1995.1^4  After  the  Bosnian  war  until  the  beginning  of  the 
Kosovo  war  in  February  1998,  most  terror  attacks  occurred  in  Bosnia,  Kosovo  and 
Albania. 

Another  spike  in  terror  events  was  recorded  after  the  Bosnian  war  and  before  as 
well  as  during  the  war  in  Kosovo  (1998-1999).  Many  of  the  events  from  this  time  period 
occurred  in  Bosnia,  Kosovo  and  Albania.  In  Kosovo,  this  was  a  result  of  the  movement  of 
many  fighters  from  Bosnia  to  support  their  brothers  in  the  KLA,  a  group  that  was  listed 
as  a  terrorist  organization,  but  after  the  war  in  Kosovo  it  was  disarmed  in  1999. 


Shay,  Islamic  Terror  and  the  Balkans,  39-73. 
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B. 


GEOSPATIAL  ANALYSIS 


A  geospatial  analysis  was  conducted  of  the  same  terror  events  used  for  the 
temporal  analysis.  Figure  3  is  a  heat  map  visualization  of  those  violent  attacks.  The  heat 
map  shows  the  majority  of  attacks  occurred  in  the  Balkans,  which  are  clustered  mainly  in 
Kosovo,  Bosnia,  Albania,  and  Macedonia.  The  largest  cluster  is  in  Kosovo,  characterized 
by  161  events.  The  heat  map  density  displays  areas  with  a  radius  of  10  km. 


Figure  3.  Terrorist  events  in  the  Balkans  (1991-2013). 

Figure  4  shows  terror  events  committed  in  Bulgaria  over  the  last  two  decades. 
According  to  GTD  the  total  number  of  terror  events  is  36,  including  25  bombings,  3 
assault  attacks,  6  assassinations,  1  hostage  kidnapping,  and  1  hijacking.  1^6  As  seen  in  the 
visualization  of  terrorist  acts  committed  in  Bulgaria  over  the  last  20  years,  there  have  not 
been  a  large  number  of  terror  activities  compared  with  other  Balkan  countries.  The  hot 

Global  Terrorism  Database,  http://www.start.umd.edu/gtd/. 
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spot  of  terror  events  is  in  the  eapital — Sofia,  whieh  is  the  largest  eity  in  Bulgaria.  There  is 
only  one  religious-based  event,  whieh  was  a  bombing  attaek  against  a  mosque  in  the  eity 
of  Kazanluk  eommitted  in  1996. There  is  an  event  against  the  Yugoslav  Consulate  in 
Sofia,  but  it  was  eommitted  by  an  unknown  perpetrator.  1^8  Most  of  the  events  are  based 
on  a  politieal  and  business  agenda.  1^9  of  partieular  interest  to  this  study  is  the  last  terror 
aet  eommitted  at  the  airport  of  Burgas,  whieh  was  direeted  by  Hezbollah  against  Israeli 
tourists  visiting  Bulgaria. 


Figure  4.  Terrorist  events  in  Bulgaria  (1991-2013)  and  Burgas  Bombing. 


C.  LINK  ANALYSIS 

Link  analysis  is  a  method  of  analyzing  networks  eonsisting  of  different  types  of 
entities  (for  example,  people,  buildings,  ears,  loeations,  events)  and  the  different  ties 
between  them,  In  order  to  eonduet  a  link  analysis,  the  eolleeted  data  on  radieal  Islam 
terrorist  aetivities  over  the  past  20  years  in  the  Balkans  were  analyzed. 


Global  Terrorism  Database,  http://www.start.umd.edu/gtd/. 
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Since  the  data  were  based  on  individuals  and  organizations  dating  baek  to  the 
early  1990s,  many  of  the  people  were  subsequently  killed  or  detained,  and  some  of  the 
organizations  have  disbanded;  however,  in  order  to  determine  the  modus  operandi  of 
terrorists  over  the  last  two  deeades  they  were  not  eliminated  from  the  data.  In  total,  as  ean 
be  seen  in  Figure  5,  the  struetured  data  that  the  histograms  present  consists  of  260  people, 
35  terrorist  organizations  and  16  eharitable  organizations.  All  of  these  entities  and  events 
are  eonnected  by  769  links.  Figure  6  shows  the  breakdown  of  entities,  links  and  events. 


Entity  Relationships  dear  selection 


T  AM  Links  (1/1) 

/  All  Links 

Figure  5.  Entities  visualized  in  Palantir  histogram. 
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D,  SOCIAL  NETWORK  ANALYSIS  (SNA) 

As  can  be  seen  from  the  temporal  analysis,  terrorist  aetivities  in  the  Balkans  have 
deereased  in  the  late  2000s.  This  is  a  result  of  the  presence  of  NATO  and  UN  forees  in 
Bosnia  and  Kosovo.  Sinee  the  current  data  about  terrorist  aetivities  is  classified  and  most 
terrorists  operating  in  the  past  have  been  killed  or  captured,  and  terror  organizations  are 
disbanded,  the  analysis  is  based  on  their  past  activities  and  modus  operandi  in  order  to 
provide  some  insights  to  possible  future  action.  . 

SNA  of  these  data  enables  a  deeper  analysis  beyond  link  analysis.  SNA  foeuses 
on  ties  between  similar  objects  (ties  between  different  people  or  ties  between 
organizations).  For  this  research,  SNA  is  conducted  on  two  levels:  1)  the  agent  level — to 
explore  the  existing  eonfiguration  of  relations  between  people  involved  in  terror  activities 
in  the  Balkans  and  2)  the  organizational  level — to  understand  the  pattern  of  interaetions 
between  different  terror  organizations. 

1.  SNA  of  Agent-by-Agent  Network 

In  order  to  aehieve  this  analysis  a  one-mode  aggregate  network  is  ereated^^i 
based  on  relations  between  people. ^^2  jn  addition  to  one-mode  data  (agent-by-agent), 
two-mode  networks,  whieh  are  known  as  affiliation  networks,  were  derived.  SNA 
assumes  that  if  two  people  participated  in  the  same  event  or  shared  the  same  organization 
(e.g.,  politieal,  charity,  religious,  terror,  etc.),  “they  are  much  more  likely  to  interact  with 
one  another  than  two  randomly  seleeted  people”  which  can  be  used  as  a  “souree  of  soeial 
ties. This  assumption  can  be  applied  to  analysis  of  the  Balkans  since  the  area  and 
organizations  are  not  large  and  people  in  an  organization  are  most  likely  to  know  eaeh 
other.  In  order  to  eonduet  SNA  of  this  network,  ORA,  UCINET,  and  Net  Draw  were 
utilized  to  obtain  basie  metries:  network  topography,  eentrality  measures,  subgroups, 

“One-Mode  Network  is  a  network  that  consists  of  a  single  set  of  actors.” 

1^2.  Everton,  Disrupting  Dark  Networks,  402. 

163.  “Two-Mode  network  consists  of  two  sets  of  actors  or  one  set  of  actors  and  one  set  of  events.” 
Everton,  Disrupting  Dark  Networks,  403. 

164.  Everton,  Disrupting  Dark  Networks,  102. 
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brokers,  bridges  and  struetural  holes.  An  overall  picture  of  the  agent-by-agent  network 
based  on  all  connections  is  displayed  in  Figure  6. 


Figure  6.  Agent-by-agent  network  visualized  in  NetDraw. 
a.  Network  Topography  Metrics 

The  topography  of  a  network  illustrates  its  overall  structure,  and  has  a  significant 
influence  on  its  members,  For  instance,  in  more  dense  networks,  there  are  more  links 
between  people,  meaning  “it  is  easier  for  people  to  monitor  the  behavior  of  others  and 
prevent  them  from  engaging  in  deviant  behavior.”  As  a  result,  people  are  more  likely  to 
follow  the  norms  and  behavior  of  the  network,  Density  of  a  network  is  equal  to  the 
number  of  actual  ties  over  the  number  of  possible  ties  of  a  network. Since  the  ties 
between  the  actors  are  aggregated,  the  network  has  to  be  dichotomized  before  calculating 
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its  density  in  order  to  count  only  its  real  ties  rather  than  its  valued  ties.i69  UCINET  is 
able  to  dichotomize  the  network  and  calculate  density,  The  results  in  our  case  are  as 
follows:  density  is  0.049,  total  number  of  ties  in  the  network  is  3311  and  the  average 
degree  is  12.735. The  density  of  the  network  shows  that  4.9  percent  of  the  total 
possible  ties  in  the  network  exist,  which  for  a  network  with  260  nodes,  means  that  the 
network  is  not  very  dense.  This  makes  sense  given  that  the  Balkans  have  been  typically 
used  as  a  “spring  board”  for  jihadists  to  venture  into  other  countries  to  stage  operations 
(e.g..  Millennium  Attack,  9/11,  Roubaix  Gangs,  Montreal  Terror  Cell,  etc.)  1^2  xhe 
average  degree,  which  is  “the  average  number  of  ties  of  each  actor,”  can  be  used  to 
calculate  “how  ‘dense’  a  network  is.”i23  For  this  particular  network,  it  is  normal  for  it  to 
be  sparse,  since  the  network  was  analyzed  for  a  long  period  of  time  (20  years)  and  most 
of  its  actors  were  not  constant  residents  in  the  Balkans.  The  average  distance  of  the 
network  (Table  1)  indicates  a  higher  speed  of  information  diffusion  amongst  the  actors  in 
the  network,  since  average  distance  is  the  average  length  between  all  actors. ^24  Network 
diameter  shows  the  dispersion  of  a  network,  and  usually  networks  with  large  diameters 
are  more  decentralized, 


Relation 

Diameter 

Average 

distance 

Fragmentation 

Distance- 

weighted 

fragmentation 

Individual 

Network 

7.000 

2.560 

0.586 

0.808 

Table  1.  Diameter,  Average  distance  and  Distance- weighted  fragmentation. 
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Network  fragmentation  and  distance-weighted  fragmentation,  in  turn,  “measure 
the  degree  to  which  a  network  is  fragmented,”  as  the  former  is  the  number  of  actors  who 
are  not  connected  to  each  other;  the  latter  measures  distance  between  actors.  The 
scores  demonstrate  that  the  network  is  not  highly  fragmented.  This  signifies  that  the 
network  is  cohesive  enough  to  provide  support  for  jihadist  activity.  A  useful  tool  of 
UCINET  measures  how  the  network  fragmentation  and  distance-weighted  fragmentation 
is  changed  by  the  removal  of  an  actor.  The  actors  whose  displacement  will  fragment  the 
network  most  strongly  and  change  scores  the  most  are  shown  in  Table  2.'^^ 


Actors 

Network  Changed 
Fragmentation 

Percent  Change  in 
Fragmentation  (%) 

Abdul  Qadir  Mukhtari 

0.609 

0.057 

Talaat  Fuad  Qassem 

0.607 

0.051 

Khalil  Deck 

0.602 

0.040 

Fateh  Kamel 

0.600 

0.034 

Alija  Izetbegovic 

0.595 

0.016 

Abu  -  Zubeida 

0.592 

0.016 

Christophe  Caze 

0.592 

0.016 

Amer  Azizi 

0.592 

0.016 

Osama  bin  Faden 

0.592 

0.016 

Ahmed  Zuhair  Handala 

0.592 

0.016 

Table  2.  Node-level  fragmentation  measures. 


Fragmentation  scores  of  all  actors  of  the  network  are  placed  in  the  table  which 
enables  comparison  among  the  scores.  The  scores  of  the  actors  do  not  differ  greatly  from 
the  highest  to  the  lowest  scores,  which  means  that  the  actors  in  the  network  are  well 
connected.  Also,  the  network  is  not  highly  centralized,  a  point  that  can  be  supported  by 
measuring  network  centralization  (Table  3). 

Eyerton,  Disrupting  Dark  Networks,  138. 
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Relation 

Degree  centralization 

Eigenvector 

centralization 

Betweenness 

centralization 

Closeness 

centralization 

Individual 

20.62% 

22.93% 

5.37% 

45.09% 

Network 

Tables.  Centralization  scores. 


Table  3  presents  network  centralization  scores.  “The  larger  a  centralization  index 
is,  the  more  likely  it  is  that  a  single  actor  is  very  central,  whereas  the  other  actors  are 
not.”  Network  centralization  is  based  on  different  centrality  measures  (betweenness, 
closeness,  eigenvector  and  degree)  1 79  and  is  equal  to  the  “difference  between  the 
network’s  largest  centrality  score  and  each  actor’s  centrality  score  to  estimate  variance  of 
actor  centrality.”  180  As  can  be  seen  from  both  scores  this  network  is  decentralized,  which 
fits  the  Balkans  context,  since  there  have  been  several  terror  organizations  operating  there 
rather  than  just  one.  The  closeness  centralization  has  high  value  compared  with  other 
centralizations,  because  they  were  calculated  by  UCINET  based  on  “reciprocal  distance 
between  actors”  (which  can  be  applied  to  this  network  since  there  are  many  isolates).  I8i 

Finally,  summarizing  all  topography  measures,  the  agent-by-agent  network  can  be 
characterized  as  relatively  decentralized,  “flat,”  relatively  sparse  and  relatively  highly 
dispersed,  with  the  ability  for  fast  diffusion  of  information  amongst  its  actors.  182 

b.  Centrality  Measures 

These  measures  demonstrate  the  potential  power  of  an  actor  based  on  its  position 
in  the  network.  183  Degree  centrality  estimates  the  number  of  ties  an  actor  has  to  other 
actors  (number  of  actor’s  ties  divided  by  all  actors’  ties)  and  means  that  an  actor  with  a 

178-  Everton,  Disrupting  Dark  Networks,  152. 

179.  xhese  will  be  explained  in  the  analyses  of  eentrality  measures. 

180-  Everton,  Disrupting  Dark  Networks,  152. 

181-  Ibid.,  154. 

182-  Ibid.,  169. 

183.  Everton,  Disrupting  Dark  Networks,  402. 
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high  degree  of  eentrality  seore  has  more  opportunity  to  direetly  influenee  others  within  a 
network.  order  to  obtain  the  number  of  eaeh  aetor’s  ties,  the  data  have  to  be 

diehotomized  and  then  analyzed  (in  this  ease,  with  UCINET  tools). Closeness 
centrality  assesses  how  elose  (on  average)  eaeh  aetor  is  to  all  other  aetors,  meaning  that 
an  aetor  with  an  elevated  eloseness  eentrality  seore  has  aeeessibility  within  a  network, 
has  more  of  an  opportunity  to  direetly  impaet  its  members  and  serves  as  a  point  for  a 
possible  rapid  diffusion  of  resourees  and  information.!*^  To  ealeulate  this  measure, 
firstly,  for  a  diseonneeted  network  (sueh  as  this  one),  the  average  reeiproeal  distanee 
(ARD)  between  aetors  in  the  network  was  used,  i*^ 

The  next  eentrality  measure  is  betweenness  centrality,  whieh  measures  the 
extent  to  whieh  eaeh  aetor  is  positioned  on  the  shortest  route  between  all  other  aetors  in  a 
network.!**  Simply  put,  an  aetor  with  a  high  betweenness  eentrality  seore  implies 
brokerage  potential  whieh  eontrols  aeeess  to  information  and  resourees.  !*9  A 
disadvantage  of  this  measure,  whieh  has  to  be  taken  into  aeeount,  is  that  “there  is  no 
guarantee  that  two  aetors  will  always  follow  the  shortest  path  between  them.”!90  The  last 
eentrality  measure  is  eigenvector  centrality,  whieh  “assumes  that  ties  to  highly  eentral 
aetors  are  more  important  than  ties  to  peripheral  aetors. ”!9!  All  eentrality  measures  are 
ealeulated  by  UCINET  and  are  shown  in  Table  4.  !92 


!*4-  Ibid.,  207. 

!*5- Ibid.,  213. 

!*!’■  Ibid.,  207. 

!*2- Ibid.,  217. 

!**■  Ibid.,  210. 

!*9- Ibid. 

!90- Ibid. 

!9!-  Everton,  Disrupting  Dark  Networks,  208. 
!92- Ibid.,  217. 
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Betweenness 

centrality 

Closeness 

centrality 

Degree  centrality 

Eigenvector 

centrality 

Anwar  Shaaban 

(5.600) 

Sakib  Mahmuljin 

(41.570) 

Anwar  Shaaban 

(25.483) 

Sakib  Mahmuljin 

(25.846) 

Abdul  Qadir  Mukhtari 

(4.967) 

Anwar  Shaaban 

(41.570) 

Sakib  Mahmuljin 

(23.938) 

Anwar  Shaaban 

(25.521) 

Sakib  Mahmuljin 

(4.584) 

Abdul  Qadir 

Mukhtari 

(40.476) 

Abdul  Qadir 

Mukhtari 

(23.552) 

Abdul  Qadir  Mukhtari 

(24.099) 

Christophe  Caze 

(3.152) 

Christophe  Caze 

(40.154) 

Christophe  Caze 

(21.236) 

Christophe  Caze 

(23.385) 

Abu  Hamza  el  -  Misri 

(2.898) 

Ali  Ahmed  Ali 

Hamad 

(39.704) 

Ali  Ahmed  Ali 

Hamad 

(20.077) 

Fateh  Kamel 

(23.070) 

Fateh  Kamel 

(2.786) 

Fateh  Kamel 

(38.739) 

Fateh  Kamel 

(19.305) 

Ahmed  Ressam 

(22.966) 

Ahmed  Zuhair  Handala 

(2.427) 

Ahmed  Zuhair 

Handala 

(38.674) 

Mustafa  Ceric 

(18.919) 

Ali  Ahmed  Ali  Hamad 

(22.881) 

Ahmed  Ressam 

(2.281) 

Ahmed  Ressam 

(37.967) 

Ahmed  Zuhair 

Handala 

(18.919) 

Ahmed  Zuhair 

Handala 

(22.799) 

Abu  Ismaili 

(2.279) 

Abu  Sulaiman  al  - 

Makki  (37.838) 

Irfan  Liekacovic 

(18.533) 

Abu  Sulaiman 

al  -Makki 

(22.796) 

All  Ahmed  All  Hamad 

(2.233) 

Khalil  Deek 

(37.066) 

Dervish  Djurdjevoc 

(18.533) 

Karim  Said  Atmani 

(22.747) 

Table  4.  Normalized  Centrality  measures  of  actor-by-actor  network. 
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Figure  7  shows  the  visualized  degree  of  centrality  in  NetDraw,  where  actors  with 
a  higher  degree  of  centrality  score  appear  larger. 


Figure  7.  Degree  centrality  in  agent-by-agent  network  visualized  in  NetDraw. 

Figure  8  shows  visualized  closeness  centrality  in  NetDraw,  where  actors  with  a 
higher  closeness  centrality  score  appear  larger. 


Figure  8.  Closeness  centrality  in  agent-by-agent  network  visualized  in  NetDraw. 
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Figure  9  shows  visualized  betweenness  centrality  in  NetDraw,  where  actors  with 
higher  betweenness  centrality  scores  appear  larger. 


Figure  9.  Betweenness  centrality  in  agent-by-agent  network  visualized  in  NetDraw. 

Figure  10  shows  visualized  eigenvector  centrality  in  NetDraw,  where  actors  with 
higher  eigenvector  centrality  scores  appear  larger. 


Finally,  summarizing  all  findings  about  centrality  measures  in  the  agent-by-agent 
network,  a  eonelusion  ean  be  made  that  top-ranked  actors  in  all  scores  are  almost  the 
same. 


c.  Subgroups 

Soeial  analysis  of  subgroups  in  a  network  is  based  on  identifieation  of  dense 
elusters  of  aetors  as  eohesive  subgroups  or  sub-networks  and  generally  assumes  that 
“soeial  interaetion  is  the  basis  for  solidarity,  shared  norms,  identity  and  collective 
behavior,  so  people  who  interaet  intensively  are  likely  to  consider  themselves  as  a  soeial 
group.”  193  xhe  analysis  of  subgroups  begins  with  identifying  the  eomponents  in  the 
network,  whieh  are  “subnetworks  in  whieh  members  are  eonneeted  to  one  another  but  are 
not  eonneeted  with  members  of  other  sub-networks.”  194  in  this  network  only  weak 
eomponents  195  can  be  identified,  rather  than  strong  eomponents,  beeause  the  network  is 
not  direeted.  196  UCINET  identified  one  main  weak  eomponent  eonsisting  of  179  nodes 
(whieh  is  68.8  pereent  of  network).  This  eomponent  ean  be  visualized  by  NetDraw’s 
tools  using  different  eolors  (Figure  11). 


193-  Everton,  Disrupting  Dark  Networks,  170. 

194.  Everton,  Disrupting  Dark  Networks,  171. 

195.  “Strong  components  take  into  consideration  the  direction  of  ties,  whereas  weak  components  do 

not.” 

196-  Everton,  Disrupting  Dark  Networks,  171. 
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Figure  1 1 .  The  main  component  shown  in  red  as  visualized  in  NetDraw. 
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d.  Bridges  and  Brokers 

Bridges  and  brokers  analyses  are  based  on  the  idea  “that  some  actors  are  more 
likely  to  control  the  flow  of  resources  than  others.”  1^7  in  SNA  there  are  different 
approaches  to  flnding  these  important  actors  in  the  process  of  disrupting  the  network  in 
the  Balkans.  In  order  to  disrupt  this  particular  network,  actors  called  outpoints must 
be  identifled,  because  their  “removal  will  disconnect  the  network  or  disconnect  a 
component  of  it.”200  By  using  ORA’s  Measure  Charts,  our  analysis  identified  24  actors. 
A  list  of  their  names  can  be  seen  in  Table  5.201 


Anwar  Shaaban 

Abu  Sulaiman  al-Makki 

Fateh  Kamel 

Abu  Zubair  al-Madani 

Ahmed  Zuhair  Handala 

Abu  el-Maali 

Karim  Said  Atmani 

Abul-Hassan  al-Madani 

Abu  Talal  al-Qasimy 

Adnan  Pezo 

Abdul  Rashim  al-  Nashiri 

Dr.  Fatih  al-Hasanayn 

Amer  Azizi 

Alija  Izetbegovic 

Abderraouf  Hannachi 

Ehsanul  Islam  Sadequee 

Cristophe  Caze 

Enaam  Arnaout 

Ayman  al  Zawahiri 

Haroun  Rashid  Asouat 

Khalil  Deck 

Talaat  Euad  Qassem 

Table  5.  Boundary  Spanners202  in  actor-by-actor  network  identified  by  ORA. 


1^2.  Everton,  Disrupting  Dark  Networks,  253. 

198-  Ibid. 

109-  UCINET  and  NetDraw  call  them  outpoints,  but  ORA-boundary  spanners. 
200.  Everton,  Disrupting  Dark  Networks,  264. 

201- Ibid.,  269. 

202.  ORA  calls  the  cutpoints  actors  boundary  spanners. 
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Also,  the  location  of  these  nodes  is  visualized  in  ORA’s  visualizer,  in  Figure  12, 
where  they  are  depicted  in  blue. 


Figure  12.  Boundary  Spanners  of  actor-by-actor  network  visualized  in  ORA. 


Since  the  network  is  well  connected  and  the  number  of  boundary  spanners  is  not 
small,  it  is  possible  that  the  removal  of  an  actor  and  all  of  the  actors  would  not  likely 
disconnect  the  entire  network.  203  Thus,  using  another  algorithm  we  were  able  to  identify 
“an  optimal  set  of  actors,  called  Key  Players,  whose  removal  either  disconnects  or 
significantly  fragments  the  network.204  Key  players  can  be  analyzed  in  two  different 
approaches:  one  is  based  on  actors  whose  removal  will  fragment  the  network;  the  other  is 
based  on  those  actors,  who  can  be  used  for  information  and/or  a  disinformation  diffusion 
campaign  (Table  6). 205  They  are  visualized  in  Figures  13  and  14. 


203.  Everton,  Disrupting  Dark  Networks,  271. 

204.  Ibid.,  272. 

205. Ibid. 


44 


Key  Players-Resulting  Fragmentation 
0.722 

Reached  Criterion 

(No,  of  distinct  persons  reached  hy  the 
key  Players:  184  (70,8%  of  network)) 

Anwar  Shaaban 

Ahmed  Ressam 

Fateh  Kamel 

Abu  Talal  al-Qasimy 

Ahmed  Zuhair  Handala 

Rasim  Delic 

Christophe  Caze 

Abd  al  Aziz  Zaher 

Alija  Izetbegovic 

Abdul  Qadir  Mukhtari 

Talaat  Fuad  Qassem 

Osama  bin  Laden 

Abdul  Qadir  Mukhtari 

Riyad  Suleiman  Ishak  al-Hajiri 

Nezim  Halilovic 

Abu  Hamza  el-Misri 

Khalil  Deck 

Aabid  Hussein  Khan 

Ali  Ahmed  Ali  Hamad 

Omer  Behmen 

Table  6.  Key  players  in  actor-by-actor  network. 


Figure  13.  Key  players’  Fragmentation  visualized  in  blue  and  larger  size  in  NetDraw 

depiction  of  actor-by-actor  network. 
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Figure  14.  Key  players’  Reaehed  Criterion  visualized  in  blue  and  larger  size  in  NetDraw 

depiction  of  actor-by-actor  network. 


Figure  15.  Actor-by- Actor  network  in  NetDraw  (without  isolates)  visualizing  Burgas 

bombing  suspects. 
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e. 


Summary  of  Agent-by-Agent  SNA 


Analyzing  the  agent-by-agent  terror  network  in  the  Balkans,  the  following 
eonclusions  ean  be  made: 

•  During  the  analysis,  no  direet  eonneetion  was  found  between 
people  in  Bulgaria  and  terrorists,  who  have  been  present  in  Bosnia, 
Kosovo,  Albania  and  Maeedonia.  Furthermore,  Figure  15  shows 
that  the  Burgas  bombing  suspects  (Meliad  Farah  and  Hassan  El 
Hajj  Hassan)  are  also  not  connected  to  the  main  component  of  the 
network  or  to  others  in  the  network. 

•  Central  figures  in  this  network  are  mainly  people  who  are  not 
residents  of  the  Balkans — mostly  former  fighters  from 
Afghanistan,  North  Africa  and  the  Middle  East.  Such  people 
include:  Abdul  Qadir  Mukhtari  (Algerian),  Talaat  Euad  Qassem 
(leader  of  Egirtian  Gama’a  Islamiyya),  Eateh  Kamel  (Algerian- 
Canadian),  Christophe  Caze  (Erench),  Osama  bin  Laden,  etc.  On 
the  other  hand,  local  people  found  as  central  actors  are  Alija 
Izetbegovic  (who  was  President  of  Bosnia  and  Herzegovina  after 
the  war),  Sakib  Mahmuljin  (a  general  and  politician),  Mustafa 
Ceric  (a  Bosnian  Muslim  cleric),  etc. 

•  The  network  is  characterized  as  decentralized.  Its  decentralized 
structure  may  be  due  to  the  fact  that  the  region  is  used  for  training 
and  as  a  spring  board  for  the  dissemination  of  radical  Islamic 
ideas — not  only  in  the  Balkans,  but  also  in  Europe.  Also,  this 
structure  is  a  result  of  the  fact  that  many  central  figures  found  in 
the  analysis  are  leaders  and  members  of  terrorist  organizations 
outside  the  Balkans,  such  as  the  Roubaix  Group  (Christophe  Caze 
and  Lionel  Dumont),  Montreal  Terror  Cell  (Karim  Said  Atmani 
and  Ahmed  Ressam),  Milan  Terror  Cell  (Rachid  Eettar  and  Youcef 
Tanout).206  Also,  they  are  related  to  carrying  out  terrorist  attacks 
outside  the  Balkans,  most  significant  of  them  are  the  “Millenium” 
Attacks  (Ahmed  Rasem),  9/11  attack  (Muhamad  Haider  Zamar, 
Nawaf  Al-Hamzi,  and  Khaled  al  Midhar),207  the  USS  Cole 
Bombing  in  Yemen  (Abu  Asim  al-Makki)  and  the  Kenia/Tanzania 
U.S.  Embassy  Bombings  (Abu  Hajer  al-Iraqi).208 


206.  Eyajj  p  Kohlmann,  Al  Qaeda ’s  Jihad  in  Europe:  The  Afghan  -  Bosnian  Network  (New  York: 
Berg  Press,  2004),  207. 

207-  Shay,  Islamic  Terror  and  the  Balkans,  123-177. 

208-  Kohlmann,  Al  Qaeda ’s  Jihad  in  Europe,  207. 

Al 


The  main  conclusion  is  that,  although  a  large  number  of  terrorists  have  been 
detained  or  killed,  the  Balkans  serve  as  a  potential  area  for  the  training  of  terrorists,  the 
spreading  of  radical  Islam  and  as  a  springboard  for  terrorism.  209 

2,  SNA  Organization  Level  of  Analysis 

Social  network  analysis  was  also  conducted  at  the  organizational  level.  A  one¬ 
mode  terror  organization-by-organization  network  was  derived  from  two-mode  data 
about  charities,  terror  organizations  and  other  organizations,  based  on  the  links  between 
people’s  affiliations  and  memberships  in  these  organizations. 210  As  a  result,  the  one¬ 
mode  network  with  35  nodes  can  be  seen  in  Figure  16. 


Figure  16.  One-mode  terrorist  organization-by-organization  network  visualized  in 

NetDraw. 


2*^9-  Shay,  Islamic  Terror  and  the  Balkans,  123-177. 
210-  Everton,  Disrupting  Dark  Networks,  76-135. 
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Similar  to  SNA  on  the  individual  level,  the  same  data  analyses  were  conducted  for 
the  terror  organizations.  After  dichotomizing  the  data  in  UCINET  the  following  network 
topography  measures  were  calculated:  density  is  0.097,  total  number  of  ties  in  the 
network  is  58  and  the  average  degree  is  3.314  (Table  7).2ii  The  density  of  the  network 
shows  that  9.7  percent  of  the  total  possible  ties  in  the  network  exist,  which  for  a  network 
with  35  nodes  means  that  the  network  is  not  very  dense. 


Relation 

Diameter 

Average 

distance 

Fragmentation 

Distance- 

weighted 

fragmentation 

Organizational 

Network 

5.000 

2.447 

0.464 

0.742 

Table  7.  Diameter,  average  distance,  fragmentation  and  distance- weighted 

fragmentation. 


Table  8  ranks  the  organizations  which,  if  removed,  will  fragment  the  network,  and 
it  shows  by  percentage  how  much  this  network  will  be  fragmented  by  removing  each 
organization  from  the  network. 


211-  Everton,  Disrupting  Dark  Networks,  147. 
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Organizations 

Network  Changed 
Fragmentation 

Percent  Change  in 
Fragmentation  (%) 

Muslim  Bosnia  Army 

0.797 

0.621 

Kosovo  Liberation  Army 

0.662 

0.370 

Al-Gama’at  Al-Islamiyya 

0.497 

0.062 

Armed  Islamic  Group 

0.496 

0.059 

(GIA) 

Hezbollah 

0.496 

0.059 

Table  8.  Node-level  fragmentation  measures  of  terror  organization-by-organization 

network. 


Furthermore,  based  on  the  scores  of  the  centralization  measures,  this  network  is 
characterized  as  relatively  decentralized.  Also,  eigenvector  centralization  is  relatively 
high,  which  can  be  interpreted  as  most  important  organizations  are  well  connected  to 
each  other  (Table  9).  This  makes  sense,  because  most  of  their  members  participated  in 
different  organizations  during  both  of  the  wars  in  Bosnia  and  Kosovo. 


Relation 

Degree 

centralization 

Eigenvector 

Betweenness 

centralization 

Betweenness 

Closeness 

centralization 

Closeness 

Eigenvector 

centralization 

Organizational 

Network 

35.918% 

69.21% 

35.86% 

61.75% 

Table  9.  Centralization  scores  of  terror  organization-by-organization  network. 
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a.  Centrality  Measures 

Regarding  centrality  measures  (Table  10),  the  Muslim  Bosnia  Army  appears  as 
the  most  central  organization,  which  may  be  due  to  the  fact  that  its  members  participated 
in  the  Kosovo  war  as  well.  Also,  the  Armed  Islamic  Group  and  Al-Gamaat  Al-Islamiyya 
have  a  high  centrality  measure,  because  many  members  of  these  organizations  were  most 
likely  part  of  El  Mujahideen  units  in  Bosnia,  and  later  in  the  Kosovo  war.  This  means  that 
they  have  had  a  significant  influence  amongst  the  people  in  the  region.  The  Roubaix 
gang2i2  appears  as  a  central  organization  as  well.  The  terror  activities  in  the  Balkans  are 
intended  not  only  to  spread  radical  Islam  there,  but  also  outside  the  Balkans.2i3 


212.  Main  members  of  this  group  were  Freneh,  i.e.,  Christophe  Caze  and  Lionel  Dumont,  who  were 
eonvineed  by  Abual  Maali  in  Islam  and  fought  for  the  Mujahidin  in  Bosnia.  After  the  war  in  Bosnia  they 
established  this  Islamie  terror  organization  in  Franee  in  order  to  support  extremists  in  Algeria. 

213-  Shay,  Islamic  Terror  and  the  Balkans,  154. 
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Betweenness 

centrality 

Closeness 

centrality 

Degree  centrality 

Eigenvector 

centrality 

Muslim  Bosnia  Army 

(37.188  ) 

Muslim  Bosnia 

Army 

(55.392) 

Muslim  Bosnia 

Army 

(50.000) 

Muslim  Bosnia 

Army 

(73.658) 

Kosovo  Liberation 

Army 

(21.034) 

Armed  Islamic 

Group  (GIA) 

(45.098) 

Kosovo  Liberation 

Army 

(35.294) 

Armed  Islamic 

Group  (GIA) 

(51.662) 

Armed  Islamie  Group 

(GIA) 

(6.068) 

Kosovo  Liberation 

Army 

(40.196) 

Armed  Islamic 

Group  (GIA) 

(29.412) 

7th  Muslim  Brigade 

(42.954) 

Abubaker  Sadeq  Unit 

(4.679) 

Al-Gama’at  Al- 

Islamiyya 

(37.745) 

7th  Muslim  Brigade 

(20.588) 

Kosovo  Liberation 

Army 

(31.444) 

Al-Gama’at  Al- 

Islamiyya 

(4.130) 

Roubaix  Gang 

(35.784) 

A1  Qaida 

(14.706) 

Roubaix  Gang 

(30.041) 

Table  10.  Normalized  eentrality  measures  of  terror  organization-by-organization 

network. 


All  four  eentrality  measures  are  visualized  by  NetDraw  in  Figures  17,  18,  19  and 

20. 
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Figure  17.  Eigenvector  centrality  in  terror  organization-by-organization  network 

visualized  in  NetDraw. 


Figure  18.  Betweenness  centrality  in  terror  organization-by-organization  network 

visualized  in  NetDraw. 
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Figure  19.  Closeness  eentrality  in  terror  organization-by-organization  network  visualized 

in  NetDraw. 


Figure  20.  Degree  eentrality  in  terror  organization-by-organization  network  visualized  in 

NetDraw. 
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b.  Subgroups 

Analyzing  subgroups,  UCINET  identified  one  main  component  of  the 
organization  network  that  consists  of  32  nodes  (which  is  91.4  percent  of  the  network). 
This  component  is  visualized  by  NetDraw  (Figure  21). 


» 


•  ■■ 


Figure  21 .  Main  component  of  organization  network  (shown  in  red)  visualized  in 

NetDraw. 

By  using  ORA’s  Measure  Charts  five  terror  organizations  were  recognized  as 
Boundary  Spanners, ^14  and  they  are  the  Muslim  Bosnia  Army,  Kosovo  Fiberation  Army, 
National  Fiberation  Army,  GIA  and  Hezbollah.  They  were  visualized  by  ORA  and  are 
shown  in  blue  in  Figure  22. 


214.  Boundary  Spanners  are  actors,  whose  removal  may  or  may  not  “disconnect  the  network  or 
components  of  it.” 

215.  Everton,  Disrupting  Dark  Networks,  269. 
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Figure  22.  Boundary  Spanners  of  organization-by-organization  network,  visualized  in 

ORA. 


c.  Key  Players 

By  using  the  UCINET  Key  Player  algorithm,  as  shown  in  Table  11,  terror 
organizations  were  found  as  key  players  and  as  reaehed  eriterion  key  players.  Both  are 
visualized  in  Figures  23  and  24. 


Key  Players-Resulting  Fragmentation 
0.951 

Reached  Criterion 

(No,  of  distinct  organizations  reached  hy 
the  key  players:  34  (97,1%  of  network)) 

Muslim  Bosnian  Army 

Kosovo  Liberation  Army 

Armed  Islamie  Group  (GIA) 

Lashkar-e-Tayyiba 

Kosovo  Liberation  Army 

Muslim  Bosnian  Army 

7th  Muslim  Brigade 

A1  Qaida 

Table  1 1 .  Key  players  of  organization-by-organization  network. 
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Figure  23.  Key  players’  Fragmentation  visualized  in  blue  in  NetDraw  of  organization-by¬ 
organization  network. 


Figure  24.  Key  players  Reaehed  Criterion  visualized  in  blue  in  NetDraw  of  organization- 

by-organization  network. 


57 


The  scores  associated  with  key  players  indicate  that  the  network  fragmentation 
after  their  removal  will  be  0.951.  This  explains  the  decrease  in  terror  events  at  the  end  of 
the  first  decade  of  this  century,  after  the  7th  Muslim  Brigade  and  KLA  were  disbanded. 

3.  Conclusions  from  SNA  Analyses 

The  main  conclusions  that  can  be  made  on  the  basis  of  SNA  analyses  of  terror 
organizations  operating  in  the  Balkans  over  the  last  20  years  include  the  following: 

•  A  strong  influence  by  terrorist  organizations  operating  outside  the  Balkans 
existed  in  this  area.  These  organizations  included  GIA,  al-Qaeda,  Al- 
Gama’at  Al-Islamiyya  and  Hezbollah.  This  is  explained  by  the  fact  that  a 
large  part  of  the  warriors  during  the  wars  in  Bosnia  and  Kosovo  have  been 
members  of  Balkans  terror  organizations. 

•  Another  important  characteristic  of  the  mode  of  operation  of  the 
organizations  is  that  the  Balkans  were  used  as  a  zone  for  training  and  for 
disseminating  radical  Islam.  This  led  to  the  formation  of  many  terrorist 
organizations  operating  outside  the  Balkans.  Among  these  groups,  which 
were  part  of  this  analysis,  are  the  Milan  Terror  Cell,  Roubaix  Terror  Cell, 
Montreal  Terror  Cell  and  the  Paris  Metro  Terror  Cell.216 


E.  DATA  FUSION 

Terror  activities  in  the  Balkans  have  decreased  at  the  end  of  the  analyzed  period 
of  time.  During  that  period  most  of  the  terror  events  have  been  outside  of  Bulgaria’s 
borders.  Social  network  analyses  on  the  individual  level  showed  that  many  of  the  key  and 
most  central  individuals  were  not  local  but  members  of  other  terrorist  organizations, 
indicating  that  there  has  been  strong  external  influence  among  the  population  of  Bosnia, 
Kosovo,  Albania  and  Macedonia.  On  the  other  hand,  the  existence  of  foreign  terror 
organizations  in  these  four  countries  shows  that  their  idea  is  to  use  this  area  for 
promoting  radical  Islam,  for  training  and  then  for  spreading  their  activity  in  the  world.  In 
other  words,  although  Everton  has  cautioned  that  “social  network  analysis  should  not  be 
seen  as  a  silver  bullet  or  substitute  for  other  critical  elements  in  the  decision  process,”^!^ 
the  SNA  conducted  on  both  the  individual  and  organizational  level  provide  strong 

216-  Kohlmann,  Al  Qaeda ’s  Jihad  in  Europe,  207. 

Everton,  Disrupting  Dark  Networks,  45. 
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evidence  that  the  Balkans  have  been  used  as  an  area  for  military  training  and  recruitment 
of  radical  Islamists,  as  well  as  a  “springboard”  for  terrorism  outside  the  Balkans. 
Although  the  analyzed  extremists  and  terror  organizations  have  not  been  actively 
operating  in  the  territory  of  Bulgaria,  it  can  be  deduced  that  the  potential  risk  for 
spreading  Islamic  radicalism  and  extremism  in  the  country  exists.  Its  dissemination  could 
happen  both  coming  from  the  aforementioned  four  countries  and  from  terror 
organizations  outside  the  Balkans,  i.e.,  A1  Qaeda,  GIA,  Al-Gama’a  Al-Islammiyya  and 
Hezbollah. 


218. 


Shay,  Islamic  Terror  and  the  Balkans,  123-177. 
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V.  STRATEGIC  OPTIONS 


The  purpose  of  this  ehapter  is  to  develop  a  eounterterrorism  strategy  that  Bulgaria 
eould  pursue  in  order  to  prevent  future  terror  activities  in  its  territory.  The  developed 
strategies  derive  from  the  analyses  completed  in  the  previous  chapter.  Three  basic 
strategies  are  recommended  and  discussed  in  the  following  sections. 

A,  STRATEGY  1:  LAW  ENFORCEMENT  NON-MILITARY  STRATEGY  TO 
COUNTER  THE  SPREAD  OF  EXTREMISM  AND  RADICALIZATION  IN 
BULGARIA 

As  seen  from  the  analyses,  terrorist  networks,  operated  mainly  in  Kosovo,  Bosnia, 
Macedonia  and  Albania  during  the  analyzed  period,  are  characterized  by  the  strong 
influence  and  participation  of  extremists  and  terrorist  organizations  outside  the  Balkans. 
In  addition,  central  individuals  in  individual  networks  are  mainly  extremists,  who  are 
veterans  of  the  war  in  Afghanistan,  and  members  of  terrorist  organizations  in  North 
Africa  and  the  Middle  East,  such  as  al-Qaeda,  Hezbollah,  GIA  and  Al-Gama’a  al- 
Islamiyya.  There  are  significant  trends  in  their  mode  of  operation  for  dissemination  of 
radical  Islam  among  the  population  in  Kosovo,  Bosnia,  Albania  and  Macedonia.  They 
have  been  using  these  countries  as  bases  in  which  they  train  extremists  in  order  to  spread 
radical  Islam  in  Europe  and  outside  of  the  continent.  Based  on  these  findings,  one 
Bulgarian  strategy  is  to  increase  border  control  and  prevent  the  penetration  of  radical 
Islamists  into  Bulgaria.  This  strategy  requires  police  and  intelligence  services  to  be  active 
in  data  collection  and  the  monitoring  of  potential  places  for  recruitment  of  radical 
Islamists,  such  as  mosques  and  schools,  as  well  as  in  tracking  the  links  between  criminal 
organizations  and  radical  extremists.  Also,  the  government  needs  to  demonstrate  its 
power  in  processing  court  cases  against  suspected  radicals  and  extremists  in  order  to 
deter  others  from  joining  the  terrorists. 
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B,  STRATEGY  2:  FINANCIAL  NON-MILITARY  STRATEGY  TO 
PREVENT  FINANCIAL  SUPPORT  COMING  FROM  TERROR  AND 
CHARITY  ORGANIZATIONS  INTO  BULGARIA 

Analyses  showed  that  this  terror  network  can  be  characterized  as  a  network 
operating  with  significant  support  coming  from  outside  of  the  Balkans.  This  support  is 
not  only  based  on  warriors  and  weapons  but  also  on  financial  resources.  According  to 
Shay,  there  have  been  numerous  Islamic  charity  organizations  supporting  terror 
organizations  by  “humanitarian  aid,  mainly  through  Islamic  charities”  in  the  Balkans 
(mainly  in  Kosovo  and  Bosnia).  In  particular,  the  organization  which  appeared  most 
central  in  the  analysis  is  the  Muslim  Bosnian  Army.2i9  “Although  the  funds  were 
designated  solely  for  humanitarian  needs,”  Shay  said,  “in  actual  fact  much  of  the  funding, 
which  came  from  the  Muslim  world,  found  its  way  to  guerilla  and  terror  movements  and 
strengthened  the  Balkan  terror  organizations  during  the  war  and  in  its  aftermath. ”220  “A 
CIA  report  written  in  1996  pointed  out  about  fifty  Islamic  charities  in  the  Balkans,  a  third 
of  which  were  connected  to  Islamic  terror  organizations  such  as  A1  Qaeda,  the  Egyptian 
Jamaah  al  Islamiyah,  Algerian  terror  organizations,  the  Hamas  and  Hezbollah.  ”221  Thus, 
this  strategy  calls  for  an  approach  to  monitor  asset  flows  in  the  country,  charitable 
support  and  bank  accounts.  In  order  to  achieve  this,  Bulgaria  should  also  increase  its 
international  cooperation  in  tracking  the  funds  of  international  terror  organizations. 

C.  STRATEGY  3.  KINETIC  MILITARY  STRATEGY 

This  strategy  is  directed  at  central  terrorists  and  central  terror  organizations  found 
in  the  analyses.  These  central  actors  have  to  be  removed  from  the  networks  by  capturing, 
killing  or  by  disrupting  the  links  between  them. 222  xhe  people  found  to  be  most  central 
(with  rankings  based  on  centrality  measures  scores  in  the  analyses)  and  the  most 
influential  among  the  others  are  Sakib  Mahmujilin,  Anwaar  Shaaban,  Abdul  Qadir 
Mukhtari  and  Christophe  Caze.  The  most  central  organizations  are  the  Bosnian  Muslim 

219-  Shay,  Islamic  Terror  and  the  Balkans,  50-64. 

220.  Ibid.,  46. 

221.  Ibid.,  49. 

222.  Roberts  and  Everton,  “Strategies  for  Combating  Dark  Networks,”  4. 
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Army  and  Kosovo  Liberation  Army.  Also,  this  strategy  can  be  directed  at  the  highly 
ranked  actors  (individuals  and  organizations)  in  terms  of  their  fragmentation  measures, 
key  player  scores  and  cut  points  scores.  Since  these  organizations  operate  outside  of 
Bulgaria,  this  strategy  can  be  pursued  by  Bulgaria  only  under  the  control  and  aegis  of  the 
United  Nations  or  Organization  for  Security  and  Co-operation  in  Europe  (OSCE)  in 
accordance  with  UN  regulations  and  rules  of  international  law.223 

D,  DECISION-MAKING  PROCESS  FOR  SELECTING  THE  MOST 

EFFECTIVE  STRATEGY 

The  recommended  strategies  are  assessed  by  the  Analytical  Hierarchy  Process, 
which  is  “a  process  for  developing  a  numerical  score  to  rank  each  decision  alternative 
based  on  how  well  each  alternative  meets  the  decision  maker’s  criteria.”224  in  order  to 
compare  these  strategies,  the  following  five  criteria  are  used: 

1 .  Eimitation  of  Civil  Eiberties.  Will  this  strategy  pose  some  threat  for  civil 
liberties  in  Bulgaria  and  create  conditions  for  ethnic  tensions  in  the 
country? 

2.  Available  Resources  for  Implementation.  Does  Bulgaria  have  the  potential 
to  conduct  the  strategy? 

3.  Potential  threats  to  people  and  critical  infrastructure.  Will  this  strategy 
create  risks  for  the  population  of  the  country? 

4.  Eimitations  of  Implementation  of  a  Strategy.  For  example,  will  this 
strategy  have  a  legal  basis  for  implementation  in  terms  of  national  and 
international  legislation? 

5.  Potential  Effectiveness  of  a  Strategy.  If  successful,  to  what  extent  can  the 
strategy  prevent  future  terror  activities  and  radicalization  of  the 
population? 

223.  Ministry  of  Defense  of  Republic  of  Bulgaria,  “Concept  for  Bulgaria’s  participation  in  operations 
for  peacekeeping,” 

littp://www.md.govemment.bg/bg/doc/tema/missions_operations/docs/Concept_Peacekeeping.pdf 

224.  William  Fox,  “Models  of  Conflict”  (lecture.  Naval  Postgraduate  School,  Monterey,  CA,  Winter 
2013) 
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Preferences  for  the  use  of  each  criterion  evaluate  how  important  each  strategy  is. 
Standard  preferences  and  the  levels  of  their  importance  are  shown  in  Table  12. 


Preference  Level 

Numerical  Value 

Equally  preferred 

1 

Moderately  preferred 

3 

Strongly  preferred 

5 

Very  strongly  preferred 

7 

Extremely  preferred 

9 

2,  4,  6,  8 

Eor  compromises  between  above 

Table  12.  Standard  preference  table. 
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Table  13  shows  the  eomparison  between  different  strategies  to  different  eriteria. 


Limitation 

of  Civil 

Liberties 

S1 

S2 

S3 

S1 

1 

1/5 

5 

S2 

5 

1 

7 

S3 

1/5 

1/7 

1 

Available 

Resources 

S1 

S2 

S3 

S1 

1 

1/3 

7 

S2 

3 

1 

7 

S3 

1/7 

1/7 

1 

Limitations  of 
Implementation 

SI 

S2 

S3 

SI 

1 

3 

7 

S2 

1/3 

1 

7 

S3 

1/7 

1/7 

1 

Potential 

Threats 

S1 

S2 

S3 

S1 

1 

1/3 

1/3 

S2 

3 

1 

7 

S3 

3 

1/7 

1 

Potential 

Effectiveness 

S1 

S2 

S3 

S1 

1 

5 

3 

S2 

1/7 

1 

1/5 

S3 

1/3 

5 

1 

Table  13.  Pairwise  comparisons  between  strategies  (SI,  S2,  and  S3)  and  criteria. 
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Table  14  shows  the  matrix  of  the  averages  of  all  eriteria  to  eaeh  strategy. 


Strategy/Criteria 

Limitation 
of  Civil 
Liberties 

Available 

Resources 

Potential 

Threats 

Limitations 

of 

Implementation 

Potential 

Effectiveness 

Strategy  1 

0.231614 

0.311284 

0.136221 

0.622741 

0.615417 

Strategy  2 

0.696531 

0.622741 

0.648664 

0.311284 

0.078434 

Strategy  3 

0.071855 

0.065975 

0.215115 

0.065975 

0.306149 

Table  14.  Matrix  of  averages  for  all  eriterions. 


Table  15  shows  the  matrix  of  the  ranking  of  all  eriteria  with  a  ealeulated 
preferenee  vector  (row  average)  for  each  criterion. 


Criteria 

Eimitation 
of  Civil 
Eiberties 

Available 

Resource 

s 

Potential 

Threats 

Eimitations  of 
Implementation 

Potential 

Effective¬ 

ness 

Preference 
Vector  for 
the  criteria 

Limitation  of 
Civil  Liberties 

1 

1/5 

1/3 

1/2 

1/7 

0.0491 

Available 

Resources 

5 

1 

3 

4 

1/3 

0.2531 

Potential 

Threats 

3 

1/3 

1 

1/2 

1/5 

0.0949 

Limitations  of 
Implementa¬ 
tion 

2 

1/4 

2 

1 

1/6 

0.1027 

Potential 

Effectiveness 

7 

3 

5 

6 

1 

0.4999 

Table  15.  Ranked  criteria  in  order  of  importance. 


As  seen  in  Table  15  potential  effectiveness  (almost  50  percent)  is  the  most 
important  criterion  followed  by  available  resources,  limitations  of  implementation, 
potential  threats  and  limitations  of  civil  liberties. 

After  multiplication  of  the  criteria  matrix  by  the  preference  vector  matrix  the 
scores  for  different  strategies  are  obtained  and  shown  in  Table  16. 
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Table  16.  Ranked  strategies. 


Table  16  shows  how  each  strategy  ranks.  These  rankings  are  as  follows:  Strategy 
1-48  percent,  Strategy  2-32  percent  and  Strategy  3-20  percent.  Based  on  these  scores 
Bulgaria  could  pursue  the  law  enforcement  approach  in  order  to  prevent  potential 
radicalization  and  extremism  on  its  territory. 
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VI.  CONCLUSION 


International  terrorism  appears  to  be  one  of  the  most  eritical  ehallenges  faeing  the 
world.  After  the  events  of  September  11,  the  London  bombing,  Madrid  bombing  and  so 
on,  terrorism  has  beeome  a  strategic  threat  to  world  peace.  Bulgaria  has  not  been  spared 
from  terror  attacks,  as  the  terror  bombing  that  targeted  Israeli  tourists  at  the  Burgas 
airport  in  2012  showed.  Although  this  attack  was  directed  at  Israelis,  it  clearly  was  a 
breach  in  Bulgaria’s  national  security. 225 

A,  THESIS  PURPOSE  REVIEW 

The  purpose  of  this  thesis  was  to  illustrate  how  a  data  collection  and  data  analysis 
process  could  assist  Bulgaria  in  developing  a  counterterrorism  strategy  to  increase  its 
national  security.  The  “recommended  strategy”  is  only  illustrative  since  it  relies  on 
limited  open-source  data  and  dated  historical  documents.  Thus,  the  real  contribution  of 
the  thesis  is  its  demonstration  of  how  to  develop  strategy  using  new  methodological 
tools — link  analysis,  geospatial  analysis,  temporal  analysis  and  social  network  analysis. 
For  example, 

•  Geospatial  analysis  of  the  Balkans  is  used  to  visualize  ethnic  distribution 
in  the  Balkans,  and  the  latter  to  visualize  geospatially  terrorist  events  over 
the  period  1991  to  2013; 

•  Temporal  analysis  is  used  to  visualize  different  types  of  terror  events 
throughout  various  time  periods  and  countries  conducted  by  using  the 
Palantir  software; 

•  Link  analysis  is  employed  to  describe  various  connections  between 
people,  terrorist  events,  and  terrorist  organizations; 

•  Social  network  analysis  using  ORA  and  UCINET  programs  visualize  the 
terror  networks  and  their  connections.  Based  on  this  analysis,  the  modes 
and  trends  of  operation  of  the  terror  groups  in  Kosovo,  Bosnia,  Albania 
and  Macedonia  can  be  highlighted. 


225]yikolay  Slatinski,  “Report:  Counterterrorism — Problems,  lessons  and  conclusions,”  Rakovski 
Defense  and  Staff  College,  Sofia,  Bulgaria,  http://nslatinski.org/?q=bg/node/431 
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•  Data  fusion  of  all  the  analyses  ean  provide  a  common  operational  picture 
to  inform  the  development  of  counterterrorism  strategies. 

•  And  finally,  the  analytical  hierarchical  process  can  be  used  as  a  decision¬ 
making  tool  to  evaluate  strategic  options  and,  based  on  the  desired  criteria, 
identify  a  preferred  strategy. 

B,  RECOMMENDATIONS 

The  analytical  process  outlined  in  this  thesis  is  recommended  to  develop 
Bulgaria’s  counterterrorist  strategies.  To  support  this  analytical  process,  the  following 
resources  and  capabilities  are  required.  Intelligence  data  need  to  be  collected  and 
structured.  Personnel  need  to  be  trained  in  data  collection,  data  structuring  and  data 
analysis.  Most  importantly,  data  analysis  needs  to  include  the  use  of  new  methodological 
tools  (e.g.,  link  analysis,  geospatial  and  temporal  analyses  and  social  network  analysis). 
With  these  resources  and  capabilities,  Bulgaria  would  be  well  positioned  to  develop  data- 
driven  strategies  to  prevent  attacks  that  threaten  its  future  security. 
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